From fdf5b9eddcfa1ead989abf9b80d8e394ea83776e Mon Sep 17 00:00:00 2001 From: "google-labs-jules[bot]" <161369871+google-labs-jules[bot]@users.noreply.github.com> Date: Sun, 26 Apr 2026 19:34:11 +0000 Subject: [PATCH] =?UTF-8?q?=F0=9F=94=92=20fix:=20mitigate=20XSS=20via=20un?= =?UTF-8?q?escaped=20set/song=20rendering?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: julesklord <801266+julesklord@users.noreply.github.com> --- js/app.js | 28 ++++++++++++++-------------- 1 file changed, 14 insertions(+), 14 deletions(-) diff --git a/js/app.js b/js/app.js index a630427..eb326d0 100644 --- a/js/app.js +++ b/js/app.js @@ -240,7 +240,7 @@ function updateModelSelector() { localStorage.setItem('fmg-ai-model', selectedModel); } modelSelect.innerHTML = providerModels.map(m => - `` + `` ).join(''); } @@ -529,9 +529,9 @@ function renderSets(){ card.className='set-card'; card.innerHTML=`
- Set ${si+1} - ${songs.length} songs · ~${durMin(songs)} min -
+ Set ${esc(si+1)} + ${esc(songs.length)} songs · ~${esc(durMin(songs))} min +
${songs.map((s,i)=>sRow(s,i,si)).join('')}
@@ -552,7 +552,7 @@ function sRow(s,i,si){ const noteIndicator = s.note ? '✎' : ''; return `
⠿ - ${i+1} + ${esc(i+1)}
${mpIcon}${esc(s.title)}
${esc(s.artist)}
@@ -781,7 +781,7 @@ function renderShows(){ return `
${esc(n.title)}
-
${date ? esc(date)+' · ' : ''}${setCount} sets · ${songCount} songs
+
${date ? esc(date)+' · ' : ''}${esc(setCount)} sets · ${esc(songCount)} songs
@@ -814,7 +814,7 @@ function renderPool(){ document.getElementById('pool-tbody').innerHTML=s.map((x,i)=>{ const gClass=esc(x.genre==='R&B'?'RnB':x.genre); return ` - ${i+1} + ${esc(i+1)} ${esc(x.title)}${esc(x.artist)} ${esc(x.genre)} ${esc(x.key)}${esc(x.bpm)}${esc(x.effort||2)}${esc(x.prog)} @@ -1128,13 +1128,13 @@ function renderExport(){ const title=document.getElementById('night-title').value||'Setlist'; const date=new Date().toLocaleDateString('en-US',{weekday:'long',year:'numeric',month:'long',day:'numeric'}); const iNames=instrs.map(i=>INSTR_DISPLAY_NAMES[i]||i).join(', '); - let html=`
${esc(title)}
${esc(date)}  ·  ${esc(iNames)}  ·  ${numSets} sets
`; + let html=`
${esc(title)}
${esc(date)}  ·  ${esc(iNames)}  ·  ${esc(numSets)} sets
`; sets.forEach((songs,si)=>{ - html+=`
Set ${si+1} — ${songs.length} songs · ~${durMin(songs)} min
+ html+=`
Set ${esc(si+1)} — ${esc(songs.length)} songs · ~${esc(durMin(songs))} min
${songs.map((s,i)=>{ const mp = mustPlay.has(s.id) ? '⚑' : ''; const note = s.note ? `
${esc(s.note)}
` : ''; - return `
${i+1}${mp}${esc(s.title)}${esc(s.artist)}${esc(s.key)}${esc(s.bpm)}
${note}`; + return `
${esc(i+1)}${mp}${esc(s.title)}${esc(s.artist)}${esc(s.key)}${esc(s.bpm)}
${note}`; }).join('')}
`; }); @@ -1146,11 +1146,11 @@ function doExportHTML(){ const iNames=instrs.map(i=>INSTR_DISPLAY_NAMES[i]||i).join(', '); let rows=''; sets.forEach((songs,si)=>{ - rows+=`
Set ${si+1} — ${songs.length} songs · ~${durMin(songs)} min
`; + rows+=`
Set ${esc(si+1)} — ${esc(songs.length)} songs · ~${esc(durMin(songs))} min
`; songs.forEach((s,idx)=>{ const note = s.note ? `
${esc(s.note)}
` : ''; const mp = mustPlay.has(s.id) ? '⚑' : ''; - rows+=`
${idx+1}${mp}${esc(s.title)}${esc(s.artist)}${esc(s.key)}${esc(s.bpm)}
${note}`; + rows+=`
${esc(idx+1)}${mp}${esc(s.title)}${esc(s.artist)}${esc(s.key)}${esc(s.bpm)}
${note}`; }); }); const c=`${esc(title)} — FMG @@ -1191,12 +1191,12 @@ function doExportPDF(){ if(!w){toast('Pop-up blocked — allow pop-ups for PDF');return;} let rows=''; sets.forEach((songs,si)=>{ - rows+=`
Set ${si+1}  ·  ${songs.length} songs  ·  ~${durMin(songs)} min
`; + rows+=`
Set ${esc(si+1)}  ·  ${esc(songs.length)} songs  ·  ~${esc(durMin(songs))} min
`; songs.forEach((s,idx)=>{ const note = s.note ? `
${esc(s.note)}
` : ''; const mp = mustPlay.has(s.id) ? '⚑ ' : ''; rows+=`
- ${idx+1} + ${esc(idx+1)} ${mp}${esc(s.title)} ${esc(s.artist)} ${esc(s.key)}