Nail/contracts-flask
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: escHtml для всех innerHTML (XSS)

Browse Source
This commit is contained in:
naeel
2026-06-28 10:24:10 +04:00
parent 992f833880
commit f985f369fb
2 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
site/static/app.js
+3 -3
View File
@@ -203,7 +203,7 @@ async function runClassify() {
if (!classifyDone) { if (!classifyDone) {
clearInterval(timer); clearInterval(timer);
clearInterval(pollTimer); clearInterval(pollTimer);
btn.innerHTML = '✗ ' + e.message; btn.innerHTML = '✗ ' + escHtml(e.message);
btn.disabled = false; btn.disabled = false;
} }
} }
@@ -291,7 +291,7 @@ window.runCompareForGroup = async function(gi, btn) {
state._activeCompare.timer = null; state._activeCompare.timer = null;
state._activeCompare.es = null; state._activeCompare.es = null;
group.compare = null; group.compare = null;
cmpBody.innerHTML += '<div style="color:var(--destructive);">✗ ' + d.message + '</div>'; cmpBody.innerHTML += '<div style="color:var(--destructive);">✗ ' + escHtml(d.message) + '</div>';
btn.innerHTML = '✗'; btn.disabled = false; btn.innerHTML = '✗'; btn.disabled = false;
document.querySelectorAll('.cmp-btn').forEach(function(b) { b.disabled = false; }); document.querySelectorAll('.cmp-btn').forEach(function(b) { b.disabled = false; });
}, },
@@ -340,7 +340,7 @@ document.getElementById('llmBtn').addEventListener('click', function() {
lucide.createIcons(); lucide.createIcons();
}, },
onError: function(d) { onError: function(d) {
compareBody.innerHTML += '<div style="color:var(--destructive);margin-top:8px;">✗ ' + d.message + '</div>'; compareBody.innerHTML += '<div style="color:var(--destructive);margin-top:8px;">✗ ' + escHtml(d.message) + '</div>';
btn.innerHTML = '<i data-lucide="scale" style="width:16px;height:16px;"></i> Общее сравнение'; btn.innerHTML = '<i data-lucide="scale" style="width:16px;height:16px;"></i> Общее сравнение';
btn.disabled = false; btn.disabled = false;
}, },
site/static/compare.js
+1 -1
View File
@@ -212,7 +212,7 @@ function startCompareSSE(url, container, statusEl, callbacks) {
// ── extract_error / apply_error: показать ошибку ── // ── extract_error / apply_error: показать ошибку ──
else if (d.type === 'extract_error' || d.type === 'apply_error') { else if (d.type === 'extract_error' || d.type === 'apply_error') {
applyCompareEvent(sections, d); applyCompareEvent(sections, d);
container.innerHTML += '<div style="font-size:12px;color:var(--destructive);">✗ ' + d.filename + ': ' + d.error + '</div>'; container.innerHTML += '<div style="font-size:12px;color:var(--destructive);">✗ ' + escHtml(d.filename) + ': ' + escHtml(d.error) + '</div>';
} }
// ── done: завершение ── // ── done: завершение ──