-
-
Notifications
You must be signed in to change notification settings - Fork 51
Split points by documents #120
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Open
shadowwwind
wants to merge
43
commits into
tosdr:master
Choose a base branch
from
shadowwwind:modules
base: master
Could not load branches
Branch not found: {{ refName }}
Loading
Could not load tags
Nothing to show
Loading
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
Open
Changes from all commits
Commits
Show all changes
43 commits
Select commit
Hold shift + click to select a range
4a28e22
refactor: split background script into modular components with TypeSc…
ptgms 145eb11
fix: make firefox background script work
ptgms 1412bb1
feat: improve error handling with detailed error messages and UI updates
ptgms c2cc935
feat: add multi-language support
ptgms 6f297e1
remove src folder if exists
ptgms ba08347
defer script, rename variable
8aeb951
add document interface
78a8b53
html
d95fc5a
tmp
60091f4
merge code
65f02a8
fix types, remove any
f7efcf9
add more types
e534bef
revert serviceresponse id number to string
4381737
clean
de4ffca
Group documents wihtout points
6547ea4
fix points without docs and docs without points always showing
1c86882
fix type error
39b074a
fix typo
e12cb1a
add pointListStyle options to settings page
shadowwwind 14e8670
add default docStyle
shadowwwind 0219c4d
check pointListStyle before rendering
shadowwwind 405e067
re-add the unified pointsList
shadowwwind b55d34e
clean up
shadowwwind 15a01fd
fix Unexpected negated condition.
shadowwwind 54aa075
use for of
shadowwwind 132a165
add alt text to icon
shadowwwind 5fd853c
clean
shadowwwind 775d3b1
move a constant to constants
ptgms b944b98
fix: remove dupped id's and unused elements, change style selector to…
shadowwwind b11a284
Merge branch 'tosdr:modules' into modules
shadowwwind 1c327fb
[feat] sort docuements alphabetically
shadowwwind 31557cc
[fix] move default listStyle to constants, improve types, fix typo
shadowwwind ac1986a
Merge branch 'master' into modules
shadowwwind 81f92ed
merge
shadowwwind cedecc8
Merge pull request #1 from shadowwwind/modules
shadowwwind 585a2fd
add a list of documents with point summary to the top
shadowwwind cf45e3f
Merge pull request #2 from shadowwwind/master
shadowwwind fb35744
fix typo
shadowwwind 2ff70d6
add comments
shadowwwind 933957c
add comments, remove unused element
shadowwwind 5492575
Merge pull request #3 from shadowwwind/master
shadowwwind 15a1c18
typo
shadowwwind 3cfbc0b
Merge branch 'master' into modules
shadowwwind File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Some comments aren't visible on the classic Files Changed page.
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🔴 XSS vulnerability via unsanitized document name and URL in innerHTML
Document names and URLs from the API response are directly interpolated into HTML templates without sanitization, enabling XSS attacks.
Click to expand
Vulnerable Code Locations
In
src/scripts/views/popup/service.ts, multiple locations use unsanitized data ininnerHTML:Attack Vector
If a malicious API server (which users can configure via the API override setting at
src/scripts/views/settings/handlers.ts:42-45) returns a document with:name: "<img src=x onerror=alert('XSS')>"url: "javascript:alert('XSS')"The script will execute in the extension's context.
Impact
An attacker who tricks a user into configuring a malicious API endpoint could execute arbitrary JavaScript in the extension's privileged context, potentially accessing browser APIs and user data.
Recommendation: Use DOM APIs like
textContentfor text content, and validate/sanitize URLs before using them in href attributes. Consider using a sanitization library or escaping HTML entities.Was this helpful? React with 👍 or 👎 to provide feedback.