Replace string interpolation in SetAttribute with Playwright's Evaluate argument passing, structurally eliminating the XSS injection surface
Remove vulnerable escapeJavaScript helper which only escaped \ and ', missing ", backticks, newlines, null bytes, and unicode separators
Values are now safely passed as JavaScript arguments rather than interpolated into the expression string
Test plan
go build ./... passes
go test ./... passes
Manual verification: call SetAttribute with malicious payloads (e.g., '); alert('xss or backtick injection) and confirm they are set literally as attribute values
## Summary
- Replace string interpolation in `SetAttribute` with Playwright's `Evaluate` argument passing, structurally eliminating the XSS injection surface
- Remove vulnerable `escapeJavaScript` helper which only escaped `\` and `'`, missing `"`, backticks, newlines, null bytes, and unicode separators
- Values are now safely passed as JavaScript arguments rather than interpolated into the expression string
## Test plan
- [x] `go build ./...` passes
- [x] `go test ./...` passes
- [ ] Manual verification: call `SetAttribute` with malicious payloads (e.g., `'); alert('xss` or backtick injection) and confirm they are set literally as attribute values
Closes #12
**Parent:** #31 (Phase 1, PR 1)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Replace string interpolation in SetAttribute with Playwright's Evaluate
argument passing mechanism. This structurally eliminates the injection
surface — arbitrary name/value strings are safely passed as JavaScript
arguments rather than interpolated into the expression string.
The vulnerable escapeJavaScript helper (which only escaped \ and ') is
removed since it is no longer needed.
Closes#12
Co-Authored-By: Claude Opus 4.6 <[email protected]>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Summary
SetAttributewith Playwright'sEvaluateargument passing, structurally eliminating the XSS injection surfaceescapeJavaScripthelper which only escaped\and', missing", backticks, newlines, null bytes, and unicode separatorsTest plan
go build ./...passesgo test ./...passesSetAttributewith malicious payloads (e.g.,'); alert('xssor backtick injection) and confirm they are set literally as attribute valuesCloses #12
Parent: #31 (Phase 1, PR 1)
🤖 Generated with Claude Code