diff options
Diffstat (limited to 'modules/core/module-simplegui.js')
| -rw-r--r-- | modules/core/module-simplegui.js | 13 |
1 files changed, 11 insertions, 2 deletions
diff --git a/modules/core/module-simplegui.js b/modules/core/module-simplegui.js index 09d172a..bdd5f66 100644 --- a/modules/core/module-simplegui.js +++ b/modules/core/module-simplegui.js @@ -29,13 +29,22 @@ } const label = args[0], command = args.slice(1).join(' '); const id = 'gui-btn-' + Date.now(); - const safeCmd = command.replace(/'/g, "\\'"); + // v4.5.68: Use addEventListener instead of onclick attribute to prevent quote-breaking XSS this.terminal.printHTML(`<div style="margin: 5px 0;"> - <button class="qa-btn" onclick="(window.webx11||window).executeCommand('${safeCmd}')" id="${id}">${label}</button> + <button class="qa-btn" id="${id}">${this._escapeHtml(label)}</button> </div>`); + const btn = document.getElementById(id); + if (btn) { + btn.addEventListener('click', () => { + (window.webx11 || window).executeCommand(command); + }); + } this.guiElements[id] = { type: 'button', label, command }; this.terminal.print(`Button '${label}' created`, "success"); } + _escapeHtml(str) { + return String(str).replace(/&/g, '&').replace(/</g, '<').replace(/>/g, '>').replace(/"/g, '"').replace(/'/g, '''); + } createInput(args) { if (args.length < 2) { this.terminal.print("Usage: gui-input <placeholder> <varName>", "warning"); return; |