Mohammed Qazi de4832ba1a fix(design): escape url.origin when injecting into served HTML ...

serve.ts injected url.origin into a single-quoted JS string in
the response body. A local request with a crafted Host header
(e.g. Host: "evil'-alert(1)-'x") would break out of the string
and execute JS in the 127.0.0.1:<port> origin opened by the
design board. Low severity — bound to localhost, requires a
local attacker — but no reason not to escape.

Fix: JSON.stringify(url.origin) produces a properly quoted,
escaped JS string literal in one call.

Also includes Prettier reformatting (single→double quotes,
trailing commas, line wrapping) applied by the repo's
PostToolUse formatter hook. Security change is the one line
in the HTML injection; everything else is whitespace/style.

2026-04-21 20:36:48 -07:00

..

src

fix(design): escape url.origin when injecting into served HTML

2026-04-21 20:36:48 -07:00

test

fix: community security wave — 8 PRs, 4 contributors (v0.15.13.0) (#847)

2026-04-06 00:47:04 -07:00

prototype.ts

feat: design binary — real UI mockup generation for gstack skills (v0.13.0.0) (#551)

2026-03-27 20:32:59 -06:00