You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Execute.logToPage and Execute.logToPageWithColor generate and run JavaScript code in an unsafe way:
Your sanitization logic,
.map((arg) => arg.replace(/\/g, "\\"))
.map((arg) => arg.replace(/"/g, "\""))
.map((arg) => arg.replace(/\n/g, "\\n"))
.map((arg) => "${arg}")
.join(", ");
can be bypassed by strings containing carriage returns (\r) or line/paragraph separators (\u2028 and \u2029). In your specific case, the impact is limited to a JavaScript error being thrown in the console.
To safely generate JavaScript code for use with browser.tabs.executeScript, use JSON.stringify:
.map((arg) => JSON.stringify(arg))
.join(", ");
The text was updated successfully, but these errors were encountered:
Reported by @Rob--W:
The text was updated successfully, but these errors were encountered: