diff options
Diffstat (limited to 'CHANGELOG.md')
| -rw-r--r-- | CHANGELOG.md | 19 |
1 files changed, 19 insertions, 0 deletions
diff --git a/CHANGELOG.md b/CHANGELOG.md index 41a97b2..d0f231b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,25 @@ All notable changes to the WebX11 Chat Widget are recorded here. +## 1.0.1 — 2026-11-09 + +Security and mobile fixes found by a review that rendered hostile model output in Chromium. + +- **Critical: attribute injection in linkified replies.** `escapeHtml()` escaped `& < >` by + round-tripping through `textContent`, which does not escape a double quote — so a reply containing + `https://x.test/"onclick="alert(1)//` produced a real `<a onclick=…>` and fired `alert(1)` when + clicked. Escaping now covers `"` and `'` as well. Proven both ways: the 1.0.0 file fired a dialog, + this one renders only `href/target/rel` and stays silent. +- **The launcher covered the Send button at 390 px**, making the widget unusable on a phone (the + click was intercepted by the 56 px bubble). The launcher is now hidden while the panel is open. +- Requests get an idle timeout (`idleTimeoutMs`, default 60 s, re-armed on every chunk) so a gateway + that accepts and never answers cannot leave the input disabled forever. +- An empty stream or an HTML error page returned with status 200 now shows an error line instead of + an empty bubble; a JSON body without stream framing is accepted as a whole reply. +- Closing the panel restores the host page's own `body` overflow value instead of clearing it. +- Accessibility: `aria-expanded` / `aria-controls` on the launcher, focus returns to it on Escape, + the demo page no longer blocks zoom (`user-scalable=no` removed). + ## 1.0.0 — 2026-11-09 First packaged release. |