Add local web view for sim db - #11
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 02ac26fe02
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| }).join('') + '</tr>'; | ||
| const body = rows.map(r => { | ||
| const cells = state.columns.map(c => `<td>${String(r[c] || '').replaceAll('<', '<')}</td>`).join(''); | ||
| const actions = `<td><div class="actions"><button data-job="${r.job_id}" data-action="start">start</button><button data-job="${r.job_id}" data-action="done">done</button></div></td>`; |
There was a problem hiding this comment.
renderTable inserts r.job_id directly into a data-job attribute via innerHTML. Because imported records can contain arbitrary job_id strings (for example via sync-import), a value containing quotes can break out of the attribute and execute script when the local view is opened, which can then call /api/start or /api/done and silently mutate run statuses. Build these elements with DOM APIs (setAttribute) or properly escape attribute values before templating.
Useful? React with 👍 / 👎.
| const headerCols = [...state.columns, '_actions']; | ||
| const head = '<tr>' + headerCols.map(c => { | ||
| if (c === '_actions') return '<th>actions</th>'; | ||
| return `<th><button data-sort="${c}">${c}${state.sortBy === c ? (state.desc ? ' ▼' : ' ▲') : ''}</button></th>`; |
There was a problem hiding this comment.
The sortable header HTML injects c (a column name) directly into both data-sort and button text. Column names come from row keys, and extra keys are user-controlled through imported artifacts, so a crafted key containing quotes/markup can inject DOM/script or break the table controls as soon as the page renders. Treat column names as untrusted and escape them or render with textContent/setAttribute instead of raw innerHTML.
Useful? React with 👍 / 👎.
1 participant
Summary
viewcommand that serves a lightweight browser UIVerification