Steve Dudenhoeffer
6e94bfe10f
Replace string interpolation in SetAttribute with Playwright's Evaluate argument passing mechanism. This structurally eliminates the injection surface — arbitrary name/value strings are safely passed as JavaScript arguments rather than interpolated into the expression string. The vulnerable escapeJavaScript helper (which only escaped \ and ') is removed since it is no longer needed. Closes #12 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2 lines
18 B
Go
2 lines
18 B
Go
package extractor
|