Fix XSS vulnerability in SetAttribute (#12) #32

Merged
Claude merged 1 commits from fix/escape-javascript-xss into main 2026-02-15 16:18:36 +00:00
2 changed files with 4 additions and 28 deletions
Showing only changes of commit 6e94bfe10f - Show all commits

10
node.go
View File

@@ -2,7 +2,6 @@ package extractor
import (
"fmt"
"strings"
"github.com/playwright-community/playwright-go"
)
@@ -104,11 +103,10 @@ func (n node) SetHidden(val bool) error {
return nil
}
func escapeJavaScript(s string) string {
return strings.Replace(strings.Replace(s, "\\", "\\\\", -1), "'", "\\'", -1)
}
func (n node) SetAttribute(name, value string) error {
_, err := n.locator.Evaluate(fmt.Sprintf(`(element) => element.setAttribute('%s', '%s');`, escapeJavaScript(name), escapeJavaScript(value)), nil)
_, err := n.locator.Evaluate(
`(element, args) => element.setAttribute(args.name, args.value)`,
map[string]string{"name": name, "value": value},
)
return err
}

View File

@@ -1,23 +1 @@
package extractor
import "testing"
func TestEscapeJavaScript(t *testing.T) {
tests := []struct {
input string
want string
}{
{"hello", "hello"},
{"it's", "it\\'s"},
{`back\slash`, `back\\slash`},
{`both\'`, `both\\\'`},
{"", ""},
}
for _, tt := range tests {
got := escapeJavaScript(tt.input)
if got != tt.want {
t.Errorf("escapeJavaScript(%q) = %q, want %q", tt.input, got, tt.want)
}
}
}