security: sanitize HTML in popup trusted-origins list (XSS fix)#15
Merged
melvincarvalho merged 1 commit intoMay 13, 2026
Merged
Conversation
Replace innerHTML template literal interpolation with DOM API methods (createElement, textContent, appendChild) when rendering the trusted origins list. The previous code interpolated the origin string directly into HTML, allowing an attacker who injects a malicious string into the trusted origins (e.g. <img src=x onerror="...">) to execute arbitrary JavaScript in the popup's privileged extension context, potentially exfiltrating the user's private key. Co-Authored-By: claude-flow <ruv@ruv.net>
There was a problem hiding this comment.
Pull request overview
Mitigates an XSS risk in the extension popup by avoiding HTML string interpolation when rendering the trusted-origins list, ensuring untrusted origin strings can’t execute script in the privileged popup context.
Changes:
- Replaced
innerHTML-based list rendering with safe DOM construction (createElement,textContent,appendChild) for each trusted origin entry. - Kept the empty-state rendering as a static
innerHTMLstring (not user-controlled), while preserving per-origin “Remove” functionality via click handlers.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
innerHTMLtemplate literal interpolation with DOM API methods (createElement,textContent,appendChild) when rendering the trusted origins list inpopup/popup.jsoriginstring directly into HTML via template literals, allowing an attacker who gets a malicious string into the trusted origins list (e.g.<img src=x onerror="...">) to execute arbitrary JavaScript in the popup's privileged extension context, potentially exfiltrating the user's private keyinnerHTMLusage inpopup.jsinvolves user-controlled dataTest plan
<img src=x onerror="alert(1)">) and verify it renders as escaped text, not executed HTMLCo-Authored-By: claude-flow ruv@ruv.net