Add Chrome extension with host/toolbar architecture for viewing Interactive Document files#52
Add Chrome extension with host/toolbar architecture for viewing Interactive Document files#52danmarshall with Copilot wants to merge 8 commits into
Conversation
danmarshall
changed the title
Co-authored-by: danmarshall <11507384+danmarshall@users.noreply.github.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
…ntation Co-authored-by: danmarshall <11507384+danmarshall@users.noreply.github.com>
|
@copilot nice job. Now see that we should use the host/toolbar model that we do in web/frontend and vscode. lets make sure to have all mesasge types in the common project. perhaps you can even resuse some of those instead of creating new ones. the toolbar should enable 'view source', and 'download' |
Co-authored-by: danmarshall <11507384+danmarshall@users.noreply.github.com>
| errorDiv.innerHTML = ` | ||
| <h3>Error Loading Viewer</h3> | ||
| <p>${error.message}</p> | ||
| <button onclick="this.parentElement.remove()">Close</button> | ||
| `; |
Check warning
Code scanning / CodeQL
Exception text reinterpreted as HTML Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 11 months ago
To fix this vulnerability, the exception message (error.message) must be HTML-escaped before being inserted into a template string and assigned to innerHTML. This prevents malicious input from being interpreted as markup or script. A simple HTML-escaping function must be added (e.g., converting <, >, &, ", and ' to their respective HTML entities). The fix should be inserted in the same file, with the escaping function defined locally or imported if appropriate (preferably local, as we're restricted to code within the shown file). Replace the direct reference to ${error.message} on line 236 with the escaped version via escapeHtml(error.message).
Required changes:
- Add a utility function, e.g.,
escapeHtml(str: string): stringnear the top of the file. - During error display (line 236), replace interpolation of
error.messagewithescapeHtml(error.message).
| @@ -3,6 +3,16 @@ | ||
| * Licensed under the MIT License. | ||
| */ | ||
|
|
||
| // Utility to escape HTML for safe insertion into innerHTML | ||
| function escapeHtml(str: string): string { | ||
| return str | ||
| .replace(/&/g, '&') | ||
| .replace(/</g, '<') | ||
| .replace(/>/g, '>') | ||
| .replace(/"/g, '"') | ||
| .replace(/'/g, '''); | ||
| } | ||
|
|
||
| // Content script that runs on pages with .idoc files | ||
| (function() { | ||
| 'use strict'; | ||
| @@ -233,7 +243,7 @@ | ||
| `; | ||
| errorDiv.innerHTML = ` | ||
| <h3>Error Loading Viewer</h3> | ||
| <p>${error.message}</p> | ||
| <p>${escapeHtml(error.message)}</p> | ||
| <button onclick="this.parentElement.remove()">Close</button> | ||
| `; | ||
| document.body.appendChild(errorDiv); |
Co-authored-by: danmarshall <11507384+danmarshall@users.noreply.github.com>
I've refactored the Chrome extension to use the host/toolbar model as requested. The changes include:
The toolbar now properly supports viewing source code and downloading files as requested. The implementation follows the established host/toolbar model throughout the codebase. Commit: 52a0fdd |
|
@copilot can you undo your package-lock, merge main, and then regenerate it? |
…opilot/fix-2a1a315d-3920-477b-ae2a-6148752c1e85 # Please enter a commit message to explain why this merge is necessary, # especially if it merges an updated upstream into a topic branch. # # Lines starting with '#' will be ignored, and an empty message aborts # the commit.
Co-authored-by: danmarshall <11507384+danmarshall@users.noreply.github.com>
The Chrome extension now follows the established host/toolbar architecture and has been properly synchronized with the latest main branch. The package-lock.json has been regenerated to reflect the current dependency state after merging main.
💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.