From fba6df22dae297c89fa0df065628dddded66c69c Mon Sep 17 00:00:00 2001
From: Agando <roduccomm@gmail.com>
Date: Thu, 18 Jun 2026 06:00:40 +0200
Subject: auto: 2026-06-18_06:00 changes

---
 modules/core/module-simplegui.js | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

(limited to 'modules/core/module-simplegui.js')

diff --git a/modules/core/module-simplegui.js b/modules/core/module-simplegui.js
index 09d172a..bdd5f66 100644
--- a/modules/core/module-simplegui.js
+++ b/modules/core/module-simplegui.js
@@ -29,13 +29,22 @@
                 }
                 const label = args[0], command = args.slice(1).join(' ');
                 const id = 'gui-btn-' + Date.now();
-                const safeCmd = command.replace(/'/g, "\\'");
+                // v4.5.68: Use addEventListener instead of onclick attribute to prevent quote-breaking XSS
                 this.terminal.printHTML(`<div style="margin: 5px 0;">
-                    <button class="qa-btn" onclick="(window.webx11||window).executeCommand('${safeCmd}')" id="${id}">${label}</button>
+                    <button class="qa-btn" id="${id}">${this._escapeHtml(label)}</button>
                 </div>`);
+                const btn = document.getElementById(id);
+                if (btn) {
+                    btn.addEventListener('click', () => {
+                        (window.webx11 || window).executeCommand(command);
+                    });
+                }
                 this.guiElements[id] = { type: 'button', label, command };
                 this.terminal.print(`Button '${label}' created`, "success");
             }
+            _escapeHtml(str) {
+                return String(str).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;').replace(/'/g, '&#039;');
+            }
             createInput(args) {
                 if (args.length < 2) {
                     this.terminal.print("Usage: gui-input <placeholder> <varName>", "warning"); return;
-- 
cgit v1.2.3