helm/ulysses
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
ulysses/static/js
History
nopoz 076e8c93c9
fix(ui): escape model name in model-info popup (DOM-XSS) + two latent sinks (#4605) 
chatRenderer.js built the model-info popup HTML by concatenating the
model name (from the LLM response's model/answered_by field) into
popup.innerHTML without escaping, so a model advertised as an HTML/script
payload executed when the user clicked the role label. Wrap both
insertions with the uiModule.esc() helper the same function already uses.

Also apply existing escape helpers at two latent sinks flagged by CodeQL,
fed only by self-authored/server values today: document-tab title via
_esc(), and the calendar event background URL (escape the double quote
that would otherwise break out of the style="..." attribute).
2026-06-19 11:03:44 +02:00
..
calendar feat: add Sun/Mon week-start setting to calendar (#3875) (#4031) 2026-06-15 15:30:25 +09:00
color fix: theme color parsing breaks on #rgb shorthand hex (#1213) 2026-06-03 00:30:03 +09:00
compare fix: correct Three Jugs eval prompt answer (#2542) (#2544) 2026-06-15 19:21:39 +09:00
editor fix: canvasCoords crashes on empty touch list (mobile race) (#2045) 2026-06-17 10:25:39 +02:00
emailLibrary Harden email HTML URL sanitization (#2496) 2026-06-04 20:47:47 +02:00
markdown Ignore non-string markdown table rows (#1648) 2026-06-03 14:17:02 +09:00
model fix: model cost/info matches first substring key (gpt-4o-mini billed as gpt-4o) (#1439) 2026-06-04 03:05:37 +01:00
research Merge remote-tracking branch 'origin/dev' into test-main-dev-merge-20260615 2026-06-15 21:20:15 +09:00
util fix: monthly schedule label shows 21th/22th/31th (ordinal suffix for days >20) (#1577) 2026-06-03 08:57:47 +09:00
a11y.js Improve accessibility across core flows (#86) 2026-06-01 22:04:00 +02:00
admin.js refactor(tools): move model-interaction tools to the agent_tools registry (#4445) 2026-06-18 05:56:37 +00:00
assistant.js refactor(tools): move model-interaction tools to the agent_tools registry (#4445) 2026-06-18 05:56:37 +00:00
calendar.js fix(ui): escape model name in model-info popup (DOM-XSS) + two latent sinks (#4605) 2026-06-19 11:03:44 +02:00
censor.js Ignore censor preference storage errors (#1652) 2026-06-03 14:16:55 +09:00
chat.js Merge remote-tracking branch 'origin/dev' into test-main-dev-merge-20260615 2026-06-15 21:20:15 +09:00
chatRenderer.js fix(ui): escape model name in model-info popup (DOM-XSS) + two latent sinks (#4605) 2026-06-19 11:03:44 +02:00
chatStream.js Open email context for agent, email search across All Mail, cookbook serve polish 2026-06-15 20:47:51 +09:00
codeRunner.js Fix/windows llama cpp serve and test upstream (#2669) 2026-06-05 14:53:33 +02:00
colorPicker.js Odysseus v1.0 2026-05-31 23:58:26 +09:00
composerArrowUpRecall.js feat(chat): recall last user message on empty composer ArrowUp (#1175) 2026-06-08 13:06:05 +02:00
cookbook-deps-recipes.js fix(cookbook): pull llama.cpp from the ggml-org GHCR namespace (#4457) (#4490) 2026-06-18 21:29:47 +02:00
cookbook-diagnosis.js fix(cookbook): scope the "Kill vLLM" diagnosis to actual vLLM tracebacks (#4517) 2026-06-18 21:18:14 +02:00
cookbook-hwfit.js Merge remote-tracking branch 'origin/dev' into test-main-dev-merge-20260615 2026-06-15 21:20:15 +09:00
cookbook.js fix(cookbook): open() no longer crashes when a task has a diagnosis (#4417) 2026-06-16 13:35:51 +00:00
cookbookDownload.js Cookbook UI: Ollama browser, advanced serve fold, API tokens form, diagnosis toolbar, polish 2026-06-09 09:46:19 +09:00
cookbookProgressSignal.js Don't falsely declare a dependency build stale (#1568) (#1768) 2026-06-03 13:23:35 +09:00
cookbookRunning.js fix(cookbook): stop Windows process trees (#4283) 2026-06-19 00:28:25 -07:00
cookbookSchedule.js Cookbook UI: Ollama browser, advanced serve fold, API tokens form, diagnosis toolbar, polish 2026-06-09 09:46:19 +09:00
cookbookServe.js fix(cookbook): harden remote serve host handling (#4345) 2026-06-16 03:46:32 +01:00
document.js fix(ui): escape model name in model-info popup (DOM-XSS) + two latent sinks (#4605) 2026-06-19 11:03:44 +02:00
documentLibrary.js Cookbook UI: Ollama browser, advanced serve fold, API tokens form, diagnosis toolbar, polish 2026-06-09 09:46:19 +09:00
dragSort.js Odysseus v1.0 2026-05-31 23:58:26 +09:00
emailInbox.js Open email context for agent, email search across All Mail, cookbook serve polish 2026-06-15 20:47:51 +09:00
emailLibrary.js Open email context for agent, email search across All Mail, cookbook serve polish 2026-06-15 20:47:51 +09:00
emojiPicker.js Odysseus v1.0 2026-05-31 23:58:26 +09:00
emojiShortcodes.js Render emoji shortcodes as icons in chat (#345) (#629) 2026-06-05 02:28:42 +02:00
escMenuStack.js fix: make transient dropdown/popup menus close on Escape 2026-06-01 14:23:22 -04:00
fileHandler.js feat(ui): allow expanding consolidated file chip regardless of count (#1849) (#2086) 2026-06-04 14:02:52 +01:00
gallery.js Odysseus v1.0 2026-05-31 23:58:26 +09:00
galleryEditor.js Odysseus v1.0 2026-05-31 23:58:26 +09:00
group.js Harden chat streaming DOM sinks (#2498) 2026-06-04 20:49:37 +02:00
init.js fix(ui): keep minimized windows above composer (#1197) 2026-06-02 23:31:09 +09:00
keyboard-shortcuts.js Ignore AltGr keystrokes in Ctrl+Alt keyboard shortcuts (#825) 2026-06-02 11:12:54 +09:00
langIcons.js fix: langIcon throws on an explicit null opts argument (#1740) 2026-06-03 13:29:21 +09:00
markdown.js Cookbook UI: Ollama browser, advanced serve fold, API tokens form, diagnosis toolbar, polish 2026-06-09 09:46:19 +09:00
memory.js Open email context for agent, email search across All Mail, cookbook serve polish 2026-06-15 20:47:51 +09:00
modalManager.js fix(ui): share one z-order stack across Notes and modals (#3798) 2026-06-17 12:15:48 +02:00
modalSnap.js Merge remote-tracking branch 'origin/dev' into test-main-dev-merge-20260615 2026-06-15 21:20:15 +09:00
modelPicker.js Cookbook UI: Ollama browser, advanced serve fold, API tokens form, diagnosis toolbar, polish 2026-06-09 09:46:19 +09:00
models.js Cookbook UI: Ollama browser, advanced serve fold, API tokens form, diagnosis toolbar, polish 2026-06-09 09:46:19 +09:00
modelSort.js Ignore invalid model sort inputs (#1653) 2026-06-03 14:16:52 +09:00
MODULE_SUMMARY.md docs: fix stale documentation references (#1769) 2026-06-03 13:23:21 +09:00
notes.js fix(ui): share one z-order stack across Notes and modals (#3798) 2026-06-17 12:15:48 +02:00
package.json Fix test suite: ESM module loading and stub isolation (#844) 2026-06-02 11:29:29 +09:00
platform.js Ignore AltGr keystrokes in Ctrl+Alt keyboard shortcuts (#825) 2026-06-02 11:12:54 +09:00
presets.js Keep presets loading with bad local state (#1417) 2026-06-03 04:09:28 +09:00
providerDeviceFlow.js feat: add ChatGPT Subscription provider (#2876) 2026-06-08 10:19:18 +02:00
providers.js Merge remote-tracking branch 'origin/dev' into test-main-dev-merge-20260615 2026-06-15 21:20:15 +09:00
rag.js Odysseus v1.0 2026-05-31 23:58:26 +09:00
researchSynapse.js Odysseus v1.0 2026-05-31 23:58:26 +09:00
search-chat.js Odysseus v1.0 2026-05-31 23:58:26 +09:00
search.js Odysseus v1.0 2026-05-31 23:58:26 +09:00
section-management.js Fix Models section collapse dead pause and missing animation 2026-06-01 16:53:46 +02:00
sessions.js Sessions: Esc + outside-click also close the Move-to-folder submenu 2026-06-10 22:39:23 +09:00
settings.js fix(auth): centralize password and username validation constants (#4120) 2026-06-16 09:52:15 +02:00
sidebar-layout.js Odysseus v1.0 2026-05-31 23:58:26 +09:00
signature.js Constrain signature uploads to PNG data (#2844) 2026-06-05 13:17:43 +02:00
skills.js Merge remote-tracking branch 'origin/dev' into test-main-dev-merge-20260615 2026-06-15 21:20:15 +09:00
slashAutocomplete.js feat: add ChatGPT Subscription provider (#2876) 2026-06-08 10:19:18 +02:00
slashCommands.js Fix pinned skill prompt submission race (#3841) 2026-06-15 15:39:44 +09:00
spinner.js Odysseus v1.0 2026-05-31 23:58:26 +09:00
storage.js feat(agent): confine agent file/shell tools to a selectable workspace (#3665) 2026-06-11 18:17:54 +02:00
streamingRenderer.js fix(chat): stop code-block button flicker during streaming (#3023) 2026-06-06 04:08:54 -06:00
streamingSegmenter.js fix(chat): stop code-block button flicker during streaming (#3023) 2026-06-06 04:08:54 -06:00
tasks.js Tasks: optional persona for LLM + research tasks (biases output voice) 2026-06-10 23:36:18 +09:00
theme.js fix: theme color parsing breaks on #rgb shorthand hex (#1213) 2026-06-03 00:30:03 +09:00
tileManager.js fix(ui): restore all-edge modal snap zones (#2260) 2026-06-15 12:36:34 +02:00
toolWindowZOrder.js fix(ui): share one z-order stack across Notes and modals (#3798) 2026-06-17 12:15:48 +02:00
tourAutoplay.js Odysseus v1.0 2026-05-31 23:58:26 +09:00
tourHints.js Odysseus v1.0 2026-05-31 23:58:26 +09:00
tts-ai.js Odysseus v1.0 2026-05-31 23:58:26 +09:00
ui.js fix(ui): share one z-order stack across Notes and modals (#3798) 2026-06-17 12:15:48 +02:00
voiceRecorder.js Odysseus v1.0 2026-05-31 23:58:26 +09:00
windowDrag.js fix(windowDrag): disable duplicate top-edge fullscreen snap (#3495) 2026-06-15 16:10:40 +09:00
windowResize.js Make tool windows resizable by dragging edges or corners 2026-06-01 19:49:23 +02:00
workspace.js feat(agent): confine agent file/shell tools to a selectable workspace (#3665) 2026-06-11 18:17:54 +02:00