From f9f3777de239926959fb1cd312f0ea14260f69be Mon Sep 17 00:00:00 2001 From: "google-labs-jules[bot]" <161369871+google-labs-jules[bot]@users.noreply.github.com> Date: Sun, 22 Feb 2026 21:27:45 +0000 Subject: [PATCH] =?UTF-8?q?[security]=20replace=20innerHTML=20usages=20in?= =?UTF-8?q?=20landing/index.html=20=E2=80=94=20convert=20to=20safe=20DOM?= =?UTF-8?q?=20APIs?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Migrated innerHTML usage in landing/index.html to safer DOM APIs. Reduced innerHTML count from 4 to 1. One instance of innerHTML (marked.parse) was retained as it parses trusted content. Verified with lint and Playwright. Executed prompt: src/prompts/daily/innerhtml-migration-agent.md Agent: innerhtml-migration-agent Cadence: daily Co-authored-by: PR0M3TH3AN <53631862+PR0M3TH3AN@users.noreply.github.com> --- landing/index.html | 60 ++++++++++++++---- ...22T21-19-19Z__innerhtml-migration-agent.md | 14 ++++ src/context/CONTEXT_2026-02-22T21-19-19Z.md | 21 ++++++ .../DECISIONS_2026-02-22T21-19-19Z.md | 26 ++++++++ .../TEST_LOG_2026-02-22T21-19-19Z.md | 32 ++++++++++ src/todo/TODO_2026-02-22T21-19-19Z.md | 18 ++++++ ...Z__innerhtml-migration-agent__completed.md | 27 ++++++++ verification_screenshot.png | Bin 51152 -> 0 bytes 8 files changed, 185 insertions(+), 13 deletions(-) create mode 100644 memory-updates/2026-02-22T21-19-19Z__innerhtml-migration-agent.md create mode 100644 src/context/CONTEXT_2026-02-22T21-19-19Z.md create mode 100644 src/decisions/DECISIONS_2026-02-22T21-19-19Z.md create mode 100644 src/test_logs/TEST_LOG_2026-02-22T21-19-19Z.md create mode 100644 src/todo/TODO_2026-02-22T21-19-19Z.md create mode 100644 task-logs/daily/2026-02-22T21-19-19Z__innerhtml-migration-agent__completed.md delete mode 100644 verification_screenshot.png diff --git a/landing/index.html b/landing/index.html index 9fdaf7e..dc4f066 100644 --- a/landing/index.html +++ b/landing/index.html @@ -1347,7 +1347,7 @@ npm install https://github.com/PR0M3TH3AN/TORCH/archive/refs/heads/main.tar.gz & if (!response.ok) throw new Error('Failed to load roster'); const roster = await response.json(); - container.innerHTML = ''; // Clear loading state + container.replaceChildren(); // Clear loading state // Flatten roster into a single list with schedule info const allAgents = []; @@ -1421,17 +1421,47 @@ npm install https://github.com/PR0M3TH3AN/TORCH/archive/refs/heads/main.tar.gz & const card = document.createElement('div'); card.className = 'functional-agent-card'; - card.innerHTML = ` -
Error loading agents: ${error.message}
`; + const p = document.createElement('p'); + p.className = 'text-center'; + p.style.color = 'var(--danger)'; + p.textContent = `Error loading agents: ${error.message}`; + container.replaceChildren(p); } } diff --git a/memory-updates/2026-02-22T21-19-19Z__innerhtml-migration-agent.md b/memory-updates/2026-02-22T21-19-19Z__innerhtml-migration-agent.md new file mode 100644 index 0000000..e009bc4 --- /dev/null +++ b/memory-updates/2026-02-22T21-19-19Z__innerhtml-migration-agent.md @@ -0,0 +1,14 @@ +# Memory Update — innerhtml-migration-agent — 2026-02-22 + +## Key findings +- scripts/check-innerhtml.mjs is read-only and does not support --update or BASELINE updates. +- landing/index.html uses innerHTML for rendering agent cards and error messages. + +## Patterns / reusable knowledge +- Use `element.replaceChildren()` to clear content instead of `innerHTML = ''`. +- Use `document.createElement` and `textContent` to safely construct DOM elements. +- Use `element.onclick = () => func()` instead of `onclick="func()"` strings for better security. + +## Warnings / gotchas +- Verify tools before assuming they have write capabilities (like check-innerhtml.mjs). +- Ensure `escapeHtml` is not needed if using `textContent`. diff --git a/src/context/CONTEXT_2026-02-22T21-19-19Z.md b/src/context/CONTEXT_2026-02-22T21-19-19Z.md new file mode 100644 index 0000000..1d76afa --- /dev/null +++ b/src/context/CONTEXT_2026-02-22T21-19-19Z.md @@ -0,0 +1,21 @@ +--- +agent: innerhtml-migration-agent +cadence: daily +run-start: 2026-02-22T21:19:19Z +--- +# Context + +Executed prompt: src/prompts/daily/innerhtml-migration-agent.md + +Goal: Migrate innerHTML usage in landing/index.html to safe DOM APIs. +Scope: landing/index.html +Constraints: Do not break functionality. Minimize changes. + +Reason: Security hardening and reducing innerHTML count. +Date: 2026-02-22 + +Plan: +1. Replace container.innerHTML = '' with replaceChildren() +2. Replace container.innerHTML = Error... with createElement +3. Replace card.innerHTML = ... with createElement structure +4. Keep marked.parse usage as is (documented) diff --git a/src/decisions/DECISIONS_2026-02-22T21-19-19Z.md b/src/decisions/DECISIONS_2026-02-22T21-19-19Z.md new file mode 100644 index 0000000..8b3cc01 --- /dev/null +++ b/src/decisions/DECISIONS_2026-02-22T21-19-19Z.md @@ -0,0 +1,26 @@ +--- +agent: innerhtml-migration-agent +cadence: daily +run-start: 2026-02-22T21:19:19Z +--- +# Decisions + +Executed prompt: src/prompts/daily/innerhtml-migration-agent.md + +## landing/index.html + +1. **Clear loading state**: + - Decision: Use `container.replaceChildren();` + - Rationale: Safer and cleaner replacement for `innerHTML = ''`. + +2. **Error handling**: + - Decision: Use `document.createElement('p')` and set `textContent`. + - Rationale: Prevents potential injection if `error.message` contains HTML. + +3. **Agent card rendering**: + - Decision: Build DOM tree with `createElement` and `textContent`. Use `addEventListener` for button click. + - Rationale: Eliminates `innerHTML` usage, safer event handling, removes need for `escapeHtml` for text content. + +4. **Documentation modal**: + - Decision: Keep `contentDiv.innerHTML = marked.parse(text);` + - Rationale: The content comes from `../src/docs/TORCH.md`, which is a trusted file in the repository. Migrating this is out of scope. diff --git a/src/test_logs/TEST_LOG_2026-02-22T21-19-19Z.md b/src/test_logs/TEST_LOG_2026-02-22T21-19-19Z.md new file mode 100644 index 0000000..e6733f0 --- /dev/null +++ b/src/test_logs/TEST_LOG_2026-02-22T21-19-19Z.md @@ -0,0 +1,32 @@ +--- +agent: innerhtml-migration-agent +cadence: daily +run-start: 2026-02-22T21:19:19Z +--- +# Test Log + +Executed prompt: src/prompts/daily/innerhtml-migration-agent.md + +## Pre-migration + +Command: node scripts/check-innerhtml.mjs --report +Result: +dashboard/app.js: 1 assignments +landing/index.html: 4 assignments +Total assignments: 5 + +## Modifications +Applied changes to landing/index.html using replace_with_git_merge_diff. + +## Post-migration verification + +Command: npm run lint +Result: Passed + +Command: node scripts/check-innerhtml.mjs --report +Result: +dashboard/app.js: 1 assignments +landing/index.html: 1 assignments +Total assignments: 2 + +Migration successful. Reduced landing/index.html innerHTML count from 4 to 1. diff --git a/src/todo/TODO_2026-02-22T21-19-19Z.md b/src/todo/TODO_2026-02-22T21-19-19Z.md new file mode 100644 index 0000000..c9ed64a --- /dev/null +++ b/src/todo/TODO_2026-02-22T21-19-19Z.md @@ -0,0 +1,18 @@ +--- +agent: innerhtml-migration-agent +cadence: daily +run-start: 2026-02-22T21:19:19Z +--- +# TODO + +Executed prompt: src/prompts/daily/innerhtml-migration-agent.md + +File: landing/index.html + +## Completed +- [x] Line ~910: container.innerHTML = '' (Clear loading state) +- [x] Line ~970: container.innerHTML = Error... (Error handling) +- [x] Line ~933: card.innerHTML = ... (Agent card rendering) + +## Pending +- [ ] Line ~816: contentDiv.innerHTML = marked.parse(text) (Documentation modal - Keep as is) diff --git a/task-logs/daily/2026-02-22T21-19-19Z__innerhtml-migration-agent__completed.md b/task-logs/daily/2026-02-22T21-19-19Z__innerhtml-migration-agent__completed.md new file mode 100644 index 0000000..a14f6fb --- /dev/null +++ b/task-logs/daily/2026-02-22T21-19-19Z__innerhtml-migration-agent__completed.md @@ -0,0 +1,27 @@ +--- +agent: innerhtml-migration-agent +cadence: daily +run-start: 2026-02-22T21:19:19Z +platform: linux +--- +# Task Log + +Status: Success +Agent: innerhtml-migration-agent +Prompt: src/prompts/daily/innerhtml-migration-agent.md +Reason: Migration successful. Reduced innerHTML count in landing/index.html. +Learnings: +# Memory Update — innerhtml-migration-agent — 2026-02-22 + +## Key findings +- scripts/check-innerhtml.mjs is read-only and does not support --update or BASELINE updates. +- landing/index.html uses innerHTML for rendering agent cards and error messages. + +## Patterns / reusable knowledge +- Use `element.replaceChildren()` to clear content instead of `innerHTML = ''`. +- Use `document.createElement` and `textContent` to safely construct DOM elements. +- Use `element.onclick = () => func()` instead of `onclick="func()"` strings for better security. + +## Warnings / gotchas +- Verify tools before assuming they have write capabilities (like check-innerhtml.mjs). +- Ensure `escapeHtml` is not needed if using `textContent`. diff --git a/verification_screenshot.png b/verification_screenshot.png deleted file mode 100644 index 8de213c596ad71cfa8454b2cd7f5a56c1ef16d46..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 51152 zcmYIvWmuHY_cxM@u&_usONVqx$4YldcL)L^-67%9-AH$LHz?iG-674==>y;2^}n9C z_p5tm&iT}w2~k#*0=^}B3kL@Wl#%|Z3I~T+1qTOD3V?t4l7odE3kL^+llds7?v{4+ zG@QuQ8cB-`U#(P7(xM@^02!U$GALd9XIys)M`THvkT)bKkhL}%F8Li%`fQVo4C{7G z_>pjz+BWa!8|0t`k>}ygCnXR75d$Pd1UD_xce#<<+rKYmjnP<0iABmxm5c2dZF`Or z&TSwqD#b)|M9*gR2C*>3DH1=)-*|?xg&=lr(~ZVPtBfZc<~N6N^qbc5*;?2?r#>BWX<72_nc
zxf@JoC6VNN6v#?DoshPvs&c69Aco%$Tb{&ez)hcj&);|gB3jl;^SJt00kqyrmxHZb
zM#Koys=PEIIu%EtA6$? nhCB9wm-6#zkv8&=k$7>
z!o<8AqE(27YV|)mhwAt1sV}0F2r5YI#g%(PK6bB7W^aUapfmII$u~wzUOd6zDT_?4
zpH)U6mP(tdWWt#P)*ILo>r<+ll=^ihyFM3B#k9wJ@uc#--@j68J7Pk h^WiQ3qfVR=(z3iGVQ>i1GOMW-Wd14-!|naFSA&uCifEy|EreR+}e_cm;pQ~tT88SNGJ)L%)~va6#n_#tM0
z1hlH=_|po2M7a8vub^^BUHM(JSj;y4p;^{w{UzFy%l;G(pMMqKYWZeCMvESi*l6X>
z9L9kA%7!AdUo^@G_v5>?5z@npcbDk(?Pkbz2nG6dO2Lq;K=W|E;KgMChY~%~yZ*xa
z8z|MCIkaR=szziH8%=K3`6owQ;>fzMKxX`JPQ-c*bO*=xijE1A%IwBZq%VjQYsr1a
zA4I@Wb)mHCnJi3zV;~w$jzjaGLA|E1Ar52xuoy;_7e2eaH=au`LNjxs231Lgn;i5bS--|qY^@MA
zb8Y<$SLh8dz3)x^Uf78bW;Sh&Dg;o<9XQc|Fv=`RaTf4eIHKQKI>+qm-EM9`{)$l!
zX43Lx1T=a~6PcVyWVTuE$#-TM^~BFv0!PB?6}d3KH5?`Z_!S?_Sx10byY|nKu14gc
ztl#Wt~46S#OYGHDz<3v&@5n@YXW~
z6WkNo!Bkboq|DGh6jtw!eQvH-D;n_%HH^Xa?|Q$E@EaNj82&i%%;}lrMl0|_cM5KP
zOn=iHt9*|_!KVTtjPIzF8?o0999^iD1lPB8(sKl+HF6t^E1H?g%P2Rfhj6I-h1fWN
zJIBebe8bHROQYlYlw33HPD*>OwN}Kfhw%z(23qgA74j8mn`jW5TiYV(ivya!_B#fc
zBsJU`)c%AVZ2ayld_EqK
i3`_u6GoimDgoT~5g8&cRr%zrMPkt+h<4&+Wo${s6^D&XbB<}F
z{h5vSy(Nz}^S<=%#_IjMuxee|(*?R*tSbV;&obvzSEQv2>kR*9JIqSM^$2^m9xnqO
z
D{}a*
zl2b&vWLcp9Yeg|844{^DFiGn-zMxu7l>08V-(ORFlzZX0?R%}XaS1okPGX1DAhoAA
z&-GoX+UDJMrri0@$(MtDjo?|9Z{kU_krVjXJyrQ|DOQ9enD)A)Sz0bkSX}!;wYXL^
zXKQ&C%x!);