From b92f0efd38165eb0f53fbdb9f1cff9ed39c40b34 Mon Sep 17 00:00:00 2001 From: "google-labs-jules[bot]" <161369871+google-labs-jules[bot]@users.noreply.github.com> Date: Sat, 14 Feb 2026 23:05:24 +0000 Subject: [PATCH] feat(security): migrate dashboard innerHTML to safe DOM APIs - Replace innerHTML with document.createElement and replaceChildren in dashboard/index.html - Add dashboard/domUtils.js for safe HTML escaping and element creation - Add context, decisions, and test logs - Update daily task logs Co-authored-by: PR0M3TH3AN <53631862+PR0M3TH3AN@users.noreply.github.com> --- .scheduler-memory/retrieve-daily.json | 15 ++ .scheduler-memory/retrieve-daily.ok | 1 + .scheduler-memory/store-daily.json | 16 ++ .scheduler-memory/store-daily.ok | 1 + dashboard/domUtils.js | 30 ++++ dashboard/index.html | 158 +++++++++--------- src/context/CONTEXT_2026-02-14T23-00-00Z.md | 12 ++ .../DECISIONS_2026-02-14T23-00-00Z.md | 22 +++ .../TEST_LOG_2026-02-14T23-00-00Z.md | 27 +++ src/todo/TODO_2026-02-14T23-00-00Z.md | 10 ++ ...Z__innerhtml-migration-agent__completed.md | 21 +++ verification/dashboard.png | Bin 0 -> 65338 bytes verification/verify_dashboard.py | 24 +++ 13 files changed, 261 insertions(+), 76 deletions(-) create mode 100644 .scheduler-memory/retrieve-daily.json create mode 100644 .scheduler-memory/retrieve-daily.ok create mode 100644 .scheduler-memory/store-daily.json create mode 100644 .scheduler-memory/store-daily.ok create mode 100644 dashboard/domUtils.js create mode 100644 src/context/CONTEXT_2026-02-14T23-00-00Z.md create mode 100644 src/decisions/DECISIONS_2026-02-14T23-00-00Z.md create mode 100644 src/test_logs/TEST_LOG_2026-02-14T23-00-00Z.md create mode 100644 src/todo/TODO_2026-02-14T23-00-00Z.md create mode 100644 task-logs/daily/2026-02-14T23-15-00Z__innerhtml-migration-agent__completed.md create mode 100644 verification/dashboard.png create mode 100644 verification/verify_dashboard.py diff --git a/.scheduler-memory/retrieve-daily.json b/.scheduler-memory/retrieve-daily.json new file mode 100644 index 0000000..65200e2 --- /dev/null +++ b/.scheduler-memory/retrieve-daily.json @@ -0,0 +1,15 @@ +{ + "cadence": "daily", + "operation": "retrieve", + "servicePath": "src/services/memory/index.js#getRelevantMemories", + "inputs": { + "agentId": "scheduler-memory-daily", + "query": "scheduler daily memory retrieval", + "events": 1 + }, + "outputs": { + "ingestedCount": 1, + "retrievedCount": 1 + }, + "status": "ok" +} \ No newline at end of file diff --git a/.scheduler-memory/retrieve-daily.ok b/.scheduler-memory/retrieve-daily.ok new file mode 100644 index 0000000..84b1719 --- /dev/null +++ b/.scheduler-memory/retrieve-daily.ok @@ -0,0 +1 @@ +MEMORY_RETRIEVED diff --git a/.scheduler-memory/store-daily.json b/.scheduler-memory/store-daily.json new file mode 100644 index 0000000..bd29e2d --- /dev/null +++ b/.scheduler-memory/store-daily.json @@ -0,0 +1,16 @@ +{ + "cadence": "daily", + "operation": "store", + "servicePath": "src/services/memory/index.js#ingestEvents", + "inputs": { + "agentId": "scheduler-memory-daily", + "events": 2 + }, + "outputs": { + "storedCount": 1, + "summaries": [ + "Store memory event A for daily Store memory event B for daily" + ] + }, + "status": "ok" +} \ No newline at end of file diff --git a/.scheduler-memory/store-daily.ok b/.scheduler-memory/store-daily.ok new file mode 100644 index 0000000..1e40bb6 --- /dev/null +++ b/.scheduler-memory/store-daily.ok @@ -0,0 +1 @@ +MEMORY_STORED diff --git a/dashboard/domUtils.js b/dashboard/domUtils.js new file mode 100644 index 0000000..6e2c218 --- /dev/null +++ b/dashboard/domUtils.js @@ -0,0 +1,30 @@ +// DOM utility functions for safe rendering + +/** + * Escapes unsafe HTML characters in a string. + * @param {string} unsafe The string to escape. + * @returns {string} The escaped string. + */ +export function escapeHtml(unsafe) { + if (unsafe == null) return ''; + return String(unsafe) + .replace(/&/g, "&") + .replace(//g, ">") + .replace(/"/g, """) + .replace(/'/g, "'"); +} + +/** + * Creates an element with optional class and text content. + * @param {string} tag The tag name. + * @param {string} [className] The class name(s). + * @param {string} [text] The text content. + * @returns {HTMLElement} The created element. + */ +export function createElement(tag, className, text) { + const el = document.createElement(tag); + if (className) el.className = className; + if (text != null) el.textContent = text; + return el; +} diff --git a/dashboard/index.html b/dashboard/index.html index 0f0ff09..894d7dd 100644 --- a/dashboard/index.html +++ b/dashboard/index.html @@ -153,6 +153,7 @@