mirror of
https://github.com/github/awesome-copilot.git
synced 2026-07-21 21:04:13 +00:00
jennyf19
967f0d8ede
Address PR review findings on the Cairn canvas extension: - XSS: replace inline onclick handlers (which used HTML-escape that does not escape single quotes) with event delegation via data-act/data-desk attributes and one document click listener that survives the innerHTML auto-refresh. - Path traversal: add isValidDeskName() and enforce it in every HTTP and canvas-action handler that takes a desk name (reject empty, /, \\, null byte, '.' and '..'). - Crash safety: String()-coerce in esc()/truncate() and guard outcomeIssues with Array.isArray so a malformed signal cannot take down the whole dashboard render. - Honest UI: the per-desk button no longer claims to 'open' a desk; it is relabeled 'path' and copies the desk's filesystem path to the clipboard with an accurate toast built via textContent (not innerHTML). - Correctness: outcome signals only pair with a signal when emitted at or after it (within 1hr), and activeCount is computed by excluding stashed desks instead of subtracting counts (no longer goes negative). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 26faf13e-639c-4a21-ac05-c0dc2bff7c62