security: escapeJavaScript is insufficient — XSS risk in SetAttribute #12

New Issue

Claude · 2026-02-14T16:06:28Z

Claude commented

2026-02-14 16:06:28 +00:00

Parent: #2

Description

In node.go:107-113, escapeJavaScript() only escapes \ and ' characters:

func escapeJavaScript(s string) string {
    return strings.Replace(strings.Replace(s, "\\", "\\\\", -1), "'", "\\'", -1)
}

func (n node) SetAttribute(name, value string) error {
    _, err := n.locator.Evaluate(
        fmt.Sprintf(`(element) => element.setAttribute('%s', '%s');`,
            escapeJavaScript(name), escapeJavaScript(value)), nil)
    return err
}

This is missing escapes for:

Newlines (\n, \r) — can break the string literal
Null bytes (\0) — can terminate strings early
Backticks — could break out of template literals in some contexts
</script> sequences — could break out of script tags
Double quotes (") — while not used in the current template, defensive escaping is good practice

If user-controlled input flows through SetAttribute, this could allow JavaScript injection in the browser context.

Fix

Replace with a proper JavaScript string escaper:

func escapeJavaScript(s string) string {
    r := strings.NewReplacer(
        "\\", "\\\\",
        "'", "\\'",
        "\"", "\\\"",
        "\n", "\\n",
        "\r", "\\r",
        "\t", "\\t",
        "\x00", "\\x00",
        "</", "<\\/",
    )
    return r.Replace(s)
}

Or better yet, pass name and value as Playwright Evaluate arguments instead of string interpolation:

_, err := n.locator.Evaluate(
    `([name, value]) => element.setAttribute(name, value)`,
    []string{name, value})

**Parent:** #2 ## Description In `node.go:107-113`, `escapeJavaScript()` only escapes `\` and `'` characters: ```go func escapeJavaScript(s string) string { return strings.Replace(strings.Replace(s, "\\", "\\\\", -1), "'", "\\'", -1) } func (n node) SetAttribute(name, value string) error { _, err := n.locator.Evaluate( fmt.Sprintf(`(element) => element.setAttribute('%s', '%s');`, escapeJavaScript(name), escapeJavaScript(value)), nil) return err } ``` This is missing escapes for: - **Newlines** (`\n`, `\r`) — can break the string literal - **Null bytes** (`\0`) — can terminate strings early - **Backticks** — could break out of template literals in some contexts - **`</script>`** sequences — could break out of script tags - **Double quotes** (`"`) — while not used in the current template, defensive escaping is good practice If user-controlled input flows through `SetAttribute`, this could allow JavaScript injection in the browser context. ## Fix Replace with a proper JavaScript string escaper: ```go func escapeJavaScript(s string) string { r := strings.NewReplacer( "\\", "\\\\", "'", "\\'", "\"", "\\\"", "\n", "\\n", "\r", "\\r", "\t", "\\t", "\x00", "\\x00", "</", "<\\/", ) return r.Replace(s) } ``` Or better yet, pass `name` and `value` as Playwright `Evaluate` arguments instead of string interpolation: ```go _, err := n.locator.Evaluate( `([name, value]) => element.setAttribute(name, value)`, []string{name, value}) ```

Claude added the priority/critical security type/task labels 2026-02-14 16:07:31 +00:00

Claude referenced this issue

2026-02-14 16:09:02 +00:00

Epic: Security Hardening #2

Claude referenced this issue

2026-02-15 15:59:00 +00:00

Master plan: address all open issues (17 PRs across 5 phases) #31

Claude referenced this issue

2026-02-15 16:11:12 +00:00

Master plan: address all open issues (17 PRs across 5 phases) #31

Claude commented

2026-02-15 16:11:48 +00:00

Starting work on this. Plan: replace string interpolation in SetAttribute with Playwright's Evaluate argument passing to eliminate the injection surface entirely. Will remove the vulnerable escapeJavaScript function and update tests.

Starting work on this. Plan: replace string interpolation in `SetAttribute` with Playwright's `Evaluate` argument passing to eliminate the injection surface entirely. Will remove the vulnerable `escapeJavaScript` function and update tests.

Claude referenced this issue from a commit

2026-02-15 16:12:50 +00:00

fix: eliminate XSS vulnerability in SetAttribute by using Playwright arg passing

Claude referenced a pull request that will close this issue

2026-02-15 16:13:00 +00:00

Fix XSS vulnerability in SetAttribute (#12) #32

Claude commented

2026-02-15 16:13:05 +00:00

Work finished. PR: #32

Replaced string interpolation with Playwright's Evaluate argument passing, eliminating the injection surface entirely. Removed the vulnerable escapeJavaScript helper.

Work finished. PR: #32 Replaced string interpolation with Playwright's `Evaluate` argument passing, eliminating the injection surface entirely. Removed the vulnerable `escapeJavaScript` helper.

Claude closed this issue

2026-02-15 16:18:37 +00:00

Claude referenced this issue from a commit

2026-02-15 16:18:38 +00:00

Merge pull request 'Fix XSS vulnerability in SetAttribute (#12)' (#32) from fix/escape-javascript-xss into main

Claude referenced this issue

2026-02-15 16:29:14 +00:00

Master plan: address all open issues (17 PRs across 5 phases) #31

Claude referenced this issue

2026-02-15 20:57:39 +00:00

Epic: Security Hardening #2

Claude referenced this issue