mirror of
https://github.com/github/awesome-copilot.git
synced 2026-07-21 21:04:13 +00:00
jennyf19
f9061f6fcc
Second review round on the Cairn canvas extension: - XSS via numeric fields: self-assessment scores, quality rating, and token counts are read from unvalidated agent JSON and interpolated into HTML/style/title. Coerce them at the source in scanSignals via toScore (clamped 0..5) and toCount (finite nonnegative int), and esc() the effort label, so a nonnumeric value can neither inject markup nor break layout/width. - CSRF: /api/stash, /api/restore, /api/open are state-changing loopback POSTs that previously accepted any origin, so a web page that guessed the port could mutate .desk-stash.json. Add isCrossSiteRequest() and reject cross-site POST /api/* (Origin / Sec-Fetch-Site check), mirroring the loopback protection in connector-namespaces/server.mjs. - Accessibility: the 5s auto-refresh replaced the whole #content subtree, dropping keyboard focus. Skip the swap when markup is unchanged and restore focus to the same desk/action button when it does change. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 26faf13e-639c-4a21-ac05-c0dc2bff7c62