bingshuo
/
zhizhi
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix: replace inline onclick with addEventListener to prevent XSS (CodeQL js/incomplete-sanitization) 

Co-authored-by: qinfendebingshuo <207279273+qinfendebingshuo@users.noreply.github.com>
Agent-Logs-Url: https://github.com/qinfendebingshuo/guanghulab/sessions/f22ed4e7-70d7-426e-ac6d-63925ec2b843
This commit is contained in:
copilot-swe-agent[bot] 2026-03-24 12:43:32 +00:00
parent 84dacd41e4
commit e7624a08c6
1 changed files with 15 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
docs/index.html
View File

@ -1844,8 +1844,21 @@ function enhanceExecBlocks(bblEl) {
const actionsDiv = document.createElement('div');
actionsDiv.className = 'exec-card-actions';
actionsDiv.innerHTML = '<button class="exec-btn exec-btn-copy" onclick="copyExecBlock(this)">📋 复制指令</button>'
+ '<button class="exec-btn exec-btn-submit" onclick="submitExecBlock(this,\'' + esc(instrId).replace(/'/g, "\\'") + '\',\'' + esc(modName).replace(/'/g, "\\'") + '\')">🚀 @铸渊执行</button>';
const copyBtn = document.createElement('button');
copyBtn.className = 'exec-btn exec-btn-copy';
copyBtn.textContent = '📋 复制指令';
copyBtn.addEventListener('click', function() { copyExecBlock(this); });
const submitBtn = document.createElement('button');
submitBtn.className = 'exec-btn exec-btn-submit';
submitBtn.textContent = '🚀 @铸渊执行';
submitBtn.dataset.instrId = instrId;
submitBtn.dataset.modName = modName;
submitBtn.addEventListener('click', function() { submitExecBlock(this, this.dataset.instrId, this.dataset.modName); });
actionsDiv.appendChild(copyBtn);
actionsDiv.appendChild(submitBtn);
pre.style.position = 'relative';
pre.appendChild(actionsDiv);
}