安全修复：Markdown / 文本对比 / 正则结果中的 DOM XSS 缓解 - #10
Draft
cursor[bot] wants to merge 1 commit into
Draft
cursor[bot] wants to merge 1 commit into
cursor[bot] wants to merge 1 commit into
Conversation
Escape user-controlled strings before assigning innerHTML, and pre-escape Markdown source before lightweight pattern replacements. Add Node tests and a CI workflow for escapeHtml parity checks. Co-authored-by: Muki182 <Muki182@users.noreply.github.com>
|
Analysis CompleteGenerated ECC bundle from 1 commits | Confidence: 50% View Pull Request #11Repository Profile
Changed Files (3)
Top hotspots
Top directories
Analysis Depth Readiness (commit-history, 21%)ECC Tools uses this to decide whether recommendations should stay at commit-history/setup guidance or expand into CI, security, harness, reference-set, AI-routing, and team backlog work.
Reference Set Readiness (0/6, 0%)
Likely Future Issues (2)
Suggested Follow-up Work (2)
Copy-ready bodies ci: add failure-mode evidence for .github/workflows/ci.yml ## Summary
- Add CI failure-mode evidence for the recently changed workflow or test-runner surface.
## Why
- Backfill CI failure-mode evidence before another workflow or test-runner change lands on the touched surface.
## Touched paths
- `.github/workflows/ci.yml`
## Validation
- Add or update a CI failure fixture, captured failing log, troubleshooting note, workflow dry-run evidence, or regression test for the changed CI/test-runner behavior.
- Run the affected workflow or test-runner entrypoint locally or in CI and record pass/fail evidence.chore: refresh lockfile and validate CI after dependency updates ## Summary
- Refresh the lockfile and rerun CI after the dependency or workflow changes in this PR.
## Why
- Package or workflow changes without a lockfile refresh tend to turn into noisy follow-up fixes after merge.
## Touched paths
- `.github/workflows/ci.yml`
## Validation
- Refresh the lockfile in the same package manager used by the repo.
- Run the repo typecheck / test / CI entrypoints that depend on the updated package graph.Generated Instincts (14)
After merging, import with: Files
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
问题与影响
在
index.html中，Markdown 预览、文本对比与正则匹配结果将用户输入直接拼进模板并赋给innerHTML。攻击者可诱导用户粘贴恶意载荷（例如包含<img onerror=...>或</span><script>...的文本），在同一页面上下文中执行脚本，构成 DOM XSS，可能导致剪贴板窃取、钓鱼或会话相关风险（视页面其它能力而定）。根因
未对用户可控文本做 HTML 转义即写入
innerHTML；Markdown 的正则替换还会把标题等捕获组原样插入 HTML。修复
escapeHtml()，对&、'、"、<、>进行实体转义。escapeHtml，再执行原有轻量级替换，使标题/加粗等捕获内容已为安全文本。escapeHtml。验证
node --test tests/*.mjs（通过）。tests/escape-html.test.mjs锁定转义行为；新增.github/workflows/ci.yml在推送/PR 时运行上述测试。