gstack

mirror of https://github.com/garrytan/gstack.git synced 2026-05-02 03:35:09 +02:00

Files

T

Garry Tan 4179390799 fix(ui): escapeHtml must escape quote characters too

DOM text-node serialization escapes & < > but NOT " or '. Call sites
that interpolate escapeHtml output inside attribute values (title="...",
data-x="...") were vulnerable to attribute-injection: an attacker-
influenced CSS property value (rule.selector, prop.value from the
inspector) or agent status field landing in one of those attributes
could break out with " onload=alert(1).

Add explicit quote escaping in escapeHtml + keep existing callers
working (no breakage — output is strictly more escaped, not less).

Caught by claude adversarial subagent. The earlier banner-layer fix
was the same class of bug but on a different code path.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-04-20 11:06:54 +08:00

icons

feat: headed mode + sidebar agent + Chrome extension (v0.12.0) (#517 )

2026-03-26 11:15:24 -06:00

background.js

fix: community security wave — 8 PRs, 4 contributors (v0.15.13.0) (#847 )

2026-04-06 00:47:04 -07:00

content.css

feat: headed mode + sidebar agent + Chrome extension (v0.12.0) (#517 )

2026-03-26 11:15:24 -06:00

content.js

refactor: AI slop reduction with cross-model quality review (v0.16.3.0) (#941 )