0fc359dda6
Some checks failed
Caterium QA / qa (push) Failing after 8m6s
Inline handlers built as onclick="fn('${esc(id)}')" were injectable:
esc() turns ' into ', which the browser decodes back to ' before
the JS runs, so an id like x');alert(1);// broke out of the string.
Ids can come from a restored backup file or a synced catalog. Add
SunSafe.jsArg (JSON.stringify + HTML escape) and use it in all 24
handlers across app-runtime.js and index.html, including the new
banquet-menu ones. Verified locally: an id containing a JS payload
is passed through as a plain string and nothing executes.
Also replace the Settings version label that still showed
v17.6.0 · 2026.09.07 with the current release, and bump the script
cache-busting string so the fix reaches browsers.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
|
||
|---|---|---|
| .. | ||
| account-center-v1780.js | ||
| auth-security-v1774.js | ||
| classic-offer-pdf-v1767.js | ||
| data-layer-v1773.js | ||
| developer-console-v1768.js | ||
| hotfix-v1763.js | ||
| login-signature-v1776.js | ||
| offer-workspace-v1769.js | ||
| ops-ux-v1762.js | ||
| order-enhancements-v1775.js | ||
| pdf-engine.js | ||
| performance.js | ||
| server-automation-v1770.js | ||
| signature-offer-pdf-v18.js | ||
| stability-v1760.css | ||
| sun-safe.js | ||
| trial-promo-developer-v181.js | ||
| ux-fixes-v1764.js | ||