From fba6df22dae297c89fa0df065628dddded66c69c Mon Sep 17 00:00:00 2001
From: Agando <roduccomm@gmail.com>
Date: Thu, 18 Jun 2026 06:00:40 +0200
Subject: auto: 2026-06-18_06:00 changes

---
 modules/ext/floating.js | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

(limited to 'modules/ext/floating.js')

diff --git a/modules/ext/floating.js b/modules/ext/floating.js
index 4c332fc..ef266da 100644
--- a/modules/ext/floating.js
+++ b/modules/ext/floating.js
@@ -198,7 +198,8 @@ class FloatingModule {
     _renderButton(el) {
         const btn = document.createElement('button');
         btn.className = 'floating-btn';
-        btn.innerHTML = el.label;
+        // v4.5.67: Use textContent to prevent XSS from saved floating elements
+        btn.textContent = el.label || '';
         btn.onclick = (e) => {
             e.stopPropagation();
             if (el.command && this.terminal) {
@@ -214,7 +215,8 @@ class FloatingModule {
 
         const header = document.createElement('div');
         header.className = 'floating-menu-header';
-        header.innerHTML = `<span class="arrow ${el.collapsed ? 'collapsed' : ''}">▼</span> ${el.label}`;
+        // v4.5.67: Sanitize label — use escaped text to prevent XSS
+        header.innerHTML = `<span class="arrow ${el.collapsed ? 'collapsed' : ''}">▼</span> ${this._escapeHtml(el.label || '')}`;
 
         const body = document.createElement('div');
         body.className = 'floating-menu-body' + (el.collapsed ? '' : ' expanded');
@@ -266,8 +268,11 @@ class FloatingModule {
         html = html.replace(/\*(.+?)\*/g, '<em>$1</em>');
         // `code`
         html = html.replace(/`([^`]+)`/g, '<code>$1</code>');
-        // [text](url)
-        html = html.replace(/\[([^\]]+)\]\(([^)]+)\)/g, '<a href="$2" target="_blank" rel="noopener">$1</a>');
+        // [text](url) — v4.5.67: sanitize URL to prevent javascript: scheme
+        html = html.replace(/\[([^\]]+)\]\(([^)]+)\)/g, (match, text, url) => {
+            const safeUrl = /^(https?:\/\/|mailto:|\/|#)/.test(url) ? url : '#';
+            return `<a href="${safeUrl}" target="_blank" rel="noopener">${text}</a>`;
+        });
         // newlines to <br>
         html = html.replace(/\n/g, '<br>');
         return html;
-- 
cgit v1.2.3