[bingenito]

Summary

• getMenuItemHtml built the tray context menu's <li> markup by interpolating MenuItem.label/.icon directly into HTML with no escaping, and MenuItem.id directly into an inline onclick JS string with no escaping. A menu item sourced from untrusted content (eg. a remote page's title) could inject markup or break out of the onclick string to run arbitrary script when the tray menu renders. label/icon are now HTML-escaped, and the onclick handler's arguments are built with JSON.stringify and then HTML-attribute-escaped as a whole (JSON.stringify's own double quotes would otherwise collide with the onclick="..." attribute delimiter).
• OpenFinMessageBus.subscribe discarded the sender uuid/name that OpenFin's InterApplicationBus.subscribe callback provides, so listener code had no way to tell who sent a message and authorize accordingly (especially since the default senderUuid is "*"). subscribe now forwards uuid/name to the listener's event object.

[codecov]

Codecov Report

❌ Patch coverage is 81.25000% with 3 lines in your changes missing coverage. Please review.
✅ Project coverage is 90.88%. Comparing base (6c5d572) to head (55e2b1a).

Files with missing lines	Patch %	Lines
packages/desktopjs-openfin/src/openfin.ts	81.25%	3 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #871      +/-   ##
==========================================
- Coverage   90.95%   90.88%   -0.08%     
==========================================
  Files          15       15              
  Lines        1161     1174      +13     
  Branches      245      253       +8     
==========================================
+ Hits         1056     1067      +11     
- Misses        100      107       +7     
+ Partials        5        0       -5     

Flag	Coverage Δ
unittests	90.88% <81.25%> (-0.08%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
packages/desktopjs-openfin/src/openfin.ts	87.78% <81.25%> (-0.11%)	⬇️

... and 2 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Copilot]

🟢 Approval recommended

No active review issues are recorded for the tray-menu escaping and sender-identity changes.

No open issues 🎉

What changed in this PR

This PR hardens OpenFin tray menu rendering against HTML and inline-script injection and exposes message sender identity so listeners can authorize incoming messages.

Changes:

• Escape menu labels, icon URLs, and serialized inline-handler arguments.
• Forward OpenFin sender uuid and name to message bus listeners.
• Add regression tests for menu escaping and sender identity forwarding.

File	Description
packages/​desktopjs-openfin/​tests/​openfin.spec.ts	Adds menu-injection regression tests and verifies sender identity forwarding.
packages/​desktopjs-openfin/​src/​openfin.ts	Escapes tray menu HTML and handler arguments; includes sender identity in message events.

_{Review effort: Balanced}