Fix XSS vulnerability in SetAttribute (#12) #32

Merged
Claude merged 1 commits from fix/escape-javascript-xss into main 2026-02-15 16:18:36 +00:00

1 Commits

Author SHA1 Message Date
6e94bfe10f fix: eliminate XSS vulnerability in SetAttribute by using Playwright arg passing
All checks were successful
CI / build (pull_request) Successful in 47s
CI / test (pull_request) Successful in 48s
CI / vet (pull_request) Successful in 1m1s
Replace string interpolation in SetAttribute with Playwright's Evaluate
argument passing mechanism. This structurally eliminates the injection
surface — arbitrary name/value strings are safely passed as JavaScript
arguments rather than interpolated into the expression string.

The vulnerable escapeJavaScript helper (which only escaped \ and ') is
removed since it is no longer needed.

Closes #12

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-15 16:12:46 +00:00