0fc359dda6
Some checks failed
Caterium QA / qa (push) Failing after 8m6s
Inline handlers built as onclick="fn('${esc(id)}')" were injectable:
esc() turns ' into ', which the browser decodes back to ' before
the JS runs, so an id like x');alert(1);// broke out of the string.
Ids can come from a restored backup file or a synced catalog. Add
SunSafe.jsArg (JSON.stringify + HTML escape) and use it in all 24
handlers across app-runtime.js and index.html, including the new
banquet-menu ones. Verified locally: an id containing a JS payload
is passed through as a plain string and nothing executes.
Also replace the Settings version label that still showed
v17.6.0 · 2026.09.07 with the current release, and bump the script
cache-busting string so the fix reaches browsers.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
|
||
|---|---|---|
| .. | ||
| app.spec.mjs | ||
| auth-security-v1774.mjs | ||
| branding-v1774.mjs | ||
| edge-security-v1774.mjs | ||
| employee-create-v1774.mjs | ||
| html-integrity-v1774.mjs | ||
| order-enhancements-v1775.mjs | ||
| playwright.config.mjs | ||
| release-check.mjs | ||
| static-security.mjs | ||