eab678adbe
Some checks failed
Caterium QA / qa (push) Has been cancelled
Inline handlers built as onclick="fn('${esc(id)}')" were injectable:
esc() turns ' into ', which the browser decodes back to ' before
the JS runs, so an id like x');alert(1);// broke out of the string.
Ids can come from a restored backup file or a synced catalog. Add
SunSafe.jsArg (JSON.stringify + HTML escape) and use it in all 23
handlers in app-runtime.js and index.html. Verified in a browser: a
payload id is passed through as a plain string and nothing executes.
Also replace the Settings version label that still showed
v17.6.0 · 2026.09.07, and bump the cache-busting version of the two
changed scripts (sun-safe.js, app-runtime.js).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
|
||
|---|---|---|
| .. | ||
| api | ||
| catalog | ||
| core | ||
| demo | ||
| fonts | ||
| help | ||
| legacy | ||
| offer-gallery | ||
| offer-templates | ||
| vendor | ||
| .htaccess | ||
| app-runtime.js | ||
| caterium-login-logo.png | ||
| caterium-mark-light.svg | ||
| index.html | ||
| manifest.webmanifest | ||
| pwa-icon-192.png | ||
| pwa-icon-512.png | ||
| refresh-login-20260912.html | ||
| service-worker.js | ||
| sun-logo.png | ||
