Fix XSS vulnerability in SetAttribute (#12) #32

Merged
Claude merged 1 commits from fix/escape-javascript-xss into main 2026-02-15 16:18:36 +00:00
2 changed files with 4 additions and 28 deletions

10
node.go
View File

@@ -2,7 +2,6 @@ package extractor
import ( import (
"fmt" "fmt"
"strings"
"github.com/playwright-community/playwright-go" "github.com/playwright-community/playwright-go"
) )
@@ -104,11 +103,10 @@ func (n node) SetHidden(val bool) error {
return nil return nil
} }
func escapeJavaScript(s string) string {
return strings.Replace(strings.Replace(s, "\\", "\\\\", -1), "'", "\\'", -1)
}
func (n node) SetAttribute(name, value string) error { func (n node) SetAttribute(name, value string) error {
_, err := n.locator.Evaluate(fmt.Sprintf(`(element) => element.setAttribute('%s', '%s');`, escapeJavaScript(name), escapeJavaScript(value)), nil) _, err := n.locator.Evaluate(
`(element, args) => element.setAttribute(args.name, args.value)`,
map[string]string{"name": name, "value": value},
)
return err return err
} }

View File

@@ -1,23 +1 @@
package extractor package extractor
import "testing"
func TestEscapeJavaScript(t *testing.T) {
tests := []struct {
input string
want string
}{
{"hello", "hello"},
{"it's", "it\\'s"},
{`back\slash`, `back\\slash`},
{`both\'`, `both\\\'`},
{"", ""},
}
for _, tt := range tests {
got := escapeJavaScript(tt.input)
if got != tt.want {
t.Errorf("escapeJavaScript(%q) = %q, want %q", tt.input, got, tt.want)
}
}
}