From 0ac6a7a584dbbf1c7e37599700db4ca866ae71fb Mon Sep 17 00:00:00 2001 From: Agando Date: Mon, 9 Nov 2026 15:36:11 +0100 Subject: fix(products): ship the reviewed 1.0.1 builds — the 1.0.0 pdf2txt never ran MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A review of all three products in Chromium found defects that only execution exposes. pdf2txt 1.0.0 DID NOT RUN. Both the packaged file and the live demo contained a duplicated const declaration inside fetchModels, so the inline script threw a SyntaxError at parse time and no handler was ever bound: no extraction, no translation, no config. Proven by extracting both inline scripts from the committed file and from spaces/chatstudio/pdf2txt.html and running node --check (SyntaxError: Identifier 'config' has already been declared). The two published versions of this product were dead on arrival. pdf2txt 1.0.1 also stops writing the API key and the whole extracted document to localStorage (sessionStorage for the key, nothing for the text), keeps paragraphs (hasEOL), splits chunks on word boundaries, reports a non-JSON 200 or a missing response field instead of writing "undefined" into the editor, re-enables Translate after a run, resets stopRequested, stops a workflow on a failed step, warns on a PDF with no text layer, recognises .PDF, fixes an unterminated mobile media query, stops the Fullscreen button covering line 1, and makes the drop zone and all 39 controls reachable and named. shiftplanner 1.0.1 fixes seven demonstrated defects: the settings modal recursed until the stack overflowed, "+ Worker" prefilled the last edited worker id and overwrote that person, date maths was off by one west of UTC (local-noon Date formatted with toISOString), same-day and overnight shift overlaps were never flagged, the generator sliders never reached state.settings, CSV export could execute a formula and broke on a quote, and the header never wrapped (390 px viewport gave a 1139 px document). Plus four data-integrity guards: unparseable saved plans are copied to a recovery key instead of silently overwritten, wrong-typed fields are normalised, unknown top-level fields survive a save, and a storage event syncs another tab. chat-widget 1.0.1 closes a critical attribute-injection XSS. escapeHtml() round-tripped through textContent, which does not escape a double quote, so a reply containing https://x.test/"onclick="alert(1)// produced a real and fired alert(1) when clicked. Proven both ways: the 1.0.0 file fired a dialog, the fixed one renders only href/target/rel and stays silent. The launcher also covered the Send button at 390 px, so the widget could not be used on a phone at all. Also in this commit: - Landing pages and demos are generated (build-product-pages.py). The "Try the demo" button used to point at spaces/chatstudio/pdf2txt.html (the dead copy above) and at a v2.1 shiftplanner with no AI panel: a demo that was a different build than the ZIP. Demos are now built into /demos// from products//, with the ../vendor/ prefix rewritten, and the publish wrapper regenerates them before every publish. - publish-public-repo.py refuses to publish a subtree with uncommitted changes. It reads git, so it silently republished the old tip while rc was 0 for every slug. --- CHANGELOG.md | 19 ++++++++ README.md | 5 +++ VERSION | 2 +- src/config.example.js | 5 +++ src/widget.html | 121 ++++++++++++++++++++++++++++++++++++++++++-------- 5 files changed, 132 insertions(+), 20 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 41a97b2..d0f231b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,25 @@ All notable changes to the WebX11 Chat Widget are recorded here. +## 1.0.1 — 2026-11-09 + +Security and mobile fixes found by a review that rendered hostile model output in Chromium. + +- **Critical: attribute injection in linkified replies.** `escapeHtml()` escaped `& < >` by + round-tripping through `textContent`, which does not escape a double quote — so a reply containing + `https://x.test/"onclick="alert(1)//` produced a real `` and fired `alert(1)` when + clicked. Escaping now covers `"` and `'` as well. Proven both ways: the 1.0.0 file fired a dialog, + this one renders only `href/target/rel` and stays silent. +- **The launcher covered the Send button at 390 px**, making the widget unusable on a phone (the + click was intercepted by the 56 px bubble). The launcher is now hidden while the panel is open. +- Requests get an idle timeout (`idleTimeoutMs`, default 60 s, re-armed on every chunk) so a gateway + that accepts and never answers cannot leave the input disabled forever. +- An empty stream or an HTML error page returned with status 200 now shows an error line instead of + an empty bubble; a JSON body without stream framing is accepted as a whole reply. +- Closing the panel restores the host page's own `body` overflow value instead of clearing it. +- Accessibility: `aria-expanded` / `aria-controls` on the launcher, focus returns to it on Escape, + the demo page no longer blocks zoom (`user-scalable=no` removed). + ## 1.0.0 — 2026-11-09 First packaged release. diff --git a/README.md b/README.md index fcea453..e5ef3d4 100644 --- a/README.md +++ b/README.md @@ -58,6 +58,7 @@ Full instructions: `docs/USAGE.md`. | `chips` | `[]` | Quick-reply buttons `[label, message]` | | `position` | `right` | `right` or `left` | | `statusLine` | `true` | Show the `Model: …` line | +| `idleTimeoutMs` | `60000` | Abort if the gateway sends nothing for this long | ## Known limitations (be aware before you buy) @@ -69,6 +70,10 @@ Full instructions: `docs/USAGE.md`. so the transcript is gone on reload (and there is no cookie banner to add). - Markdown support is intentionally minimal: bold, italic, inline code, links, line breaks. +- The widget is an inline `