Skip to content

🔒 Fix XSS vulnerability in nv-modal #33

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ManupaKDU merged 3 commits into from
Aug 15, 2026
Merged

🔒 Fix XSS vulnerability in nv-modal #33

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
9982e4b
🔒 Fix XSS vulnerability in nv-modal
google-labs-jules[bot] Aug 14, 2026
ab1ca93
🔒 Fix XSS vulnerability in nv-modal & a11y improvements
google-labs-jules[bot] Aug 14, 2026
3386f1f
🔒 Fix additional a11y color contrast violations
google-labs-jules[bot] Aug 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 20 additions & 0 deletions dashboard/package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 2 additions & 0 deletions dashboard/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,8 @@
},
"dependencies": {
"@preact/signals-core": "^1.8.0",
"@types/dompurify": "^3.0.5",
"dompurify": "^3.4.13",
"lit": "^3.2.1",
"workbox-window": "^7.4.0"
},
Expand Down
8 changes: 4 additions & 4 deletions dashboard/src/components/nv-app-store.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -97,7 +97,7 @@ export class NvAppStore extends LitElement {
.chip .swatch {
width: 7px; height: 7px; border-radius: 50%;
}
.chip .count { color: var(--ink-3); font-size: 10px; }
.chip .count { color: var(--ink-2); font-size: 10px; }
.grid {
display: grid;
grid-template-columns: repeat(auto-fill, minmax(280px, 1fr));
Expand Down Expand Up @@ -139,7 +139,7 @@ export class NvAppStore extends LitElement {
}
.badge {
padding: 1px 6px; border-radius: 4px;
background: var(--bg-3); color: var(--ink-3);
background: var(--bg-3); color: var(--ink-2);
border: 1px solid var(--line);
}
.badge.cat { color: var(--accent); border-color: oklch(0.78 0.14 70 / 0.3); }
Expand All @@ -149,7 +149,7 @@ export class NvAppStore extends LitElement {
.badge.budget { color: var(--accent-2); border-color: oklch(0.78 0.12 195 / 0.3); }
.badge.rt-running { color: var(--ok); border-color: oklch(0.78 0.14 145 / 0.5); background: oklch(0.78 0.14 145 / 0.08); }
.badge.rt-simulated { color: var(--accent); border-color: oklch(0.78 0.14 70 / 0.5); background: oklch(0.78 0.14 70 / 0.08); }
.badge.rt-mesh-only { color: var(--ink-3); border-color: var(--line); }
.badge.rt-mesh-only { color: var(--ink-2); border-color: var(--line); }
.events-feed {
background: var(--bg-2);
border: 1px solid var(--line);
Expand Down Expand Up @@ -389,7 +389,7 @@ export class NvAppStore extends LitElement {
<span class="events">${app.crate}</span>
${evCount > 0 ? html`<span class="card-events-count">⚡ ${evCount} ev</span>` : ''}
<span class="toggle ${active ? 'on' : ''}" role="switch"
aria-checked=${active}
aria-checked=${active} aria-label="Toggle ${app.crate}"
data-app-toggle=${app.id}
@click=${() => this.toggle(app)}></span>
</div>
Expand Down
2 changes: 1 addition & 1 deletion dashboard/src/components/nv-console.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,7 +66,7 @@ export class NvConsole extends LitElement {
border-left: 2px solid transparent;
}
.line:hover { background: var(--bg-1); }
.ts { color: var(--ink-4); font-size: 10.5px; padding-top: 1px; }
.ts { color: var(--ink-2); font-size: 10.5px; padding-top: 1px; }
.lvl {
font-size: 10px; font-weight: 600;
text-transform: uppercase; letter-spacing: 0.04em; padding-top: 1px;
Expand Down
6 changes: 3 additions & 3 deletions dashboard/src/components/nv-ghost-murmur.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -394,7 +394,7 @@ export class NvGhostMurmur extends LitElement {
<span class="lbl">Distance from sensor</span>
<span class="val" id="demo-dist-val">${this.formatDistance(this.distanceM)}</span>
</div>
<input type="range" id="demo-distance"
<input type="range" id="demo-distance" aria-label="Distance from sensor"
min="-2" max="5" step="0.05"
.value=${String(Math.log10(this.distanceM))}
@input=${(e: Event) => { this.distanceM = Math.pow(10, +(e.target as HTMLInputElement).value); }} />
Expand All @@ -407,7 +407,7 @@ export class NvGhostMurmur extends LitElement {
<span class="lbl">Heart dipole moment</span>
<span class="val" id="demo-moment-val">${m.toExponential(2)} A·m²</span>
</div>
<input type="range" id="demo-moment"
<input type="range" id="demo-moment" aria-label="Heart dipole moment"
min="-10" max="-6" step="0.05"
.value=${String(this.momentLog10)}
@input=${(e: Event) => { this.momentLog10 = +(e.target as HTMLInputElement).value; }} />
Expand Down Expand Up @@ -536,7 +536,7 @@ export class NvGhostMurmur extends LitElement {
</div>

<h2>RuView's three-tier mesh — what is actually buildable</h2>
<div class="architecture"> ┌──────────────────────────┐
<div class="architecture" tabindex="0"> ┌──────────────────────────┐
│ Tier 3 — NV-diamond │ Range: 0.1–2 m (lab)
│ magnetometer ring │ Status: nvsim simulator only
│ (close-confirm) │ Hardware: $$$ (≥$8k DNV-B1)
Expand Down
2 changes: 1 addition & 1 deletion dashboard/src/components/nv-inspector.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -423,7 +423,7 @@ export class NvInspector extends LitElement {
role="tab" aria-selected=${this.tab === 'witness'}
@click=${() => this.tab = 'witness'}>Witness</button>
</div>
<div class="body" role="tabpanel">
<div class="body" role="tabpanel" tabindex="0">
${this.renderHeader()}
${this.tab === 'signal' ? this.renderSignalTab()
: this.tab === 'frame' ? this.renderFrameTab()
Expand Down
3 changes: 2 additions & 1 deletion dashboard/src/components/nv-modal.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
/* Modal dialog — opened via window.dispatchEvent('nv-modal', { title, body, buttons }). */
import { LitElement, html, css } from 'lit';
import { customElement, state } from 'lit/decorators.js';
import DOMPurify from 'dompurify';

interface ModalButton {
label: string;
Expand Down Expand Up @@ -137,7 +138,7 @@ export class NvModal extends LitElement {
<div class="ttl">${this.mTitle}</div>
<button class="close" @click=${() => this.close()}>×</button>
</div>
<div class="body" .innerHTML=${this.mBody}></div>
<div class="body" .innerHTML=${DOMPurify.sanitize(this.mBody)}></div>
<div class="f">
${this.buttons.map((b) => html`
<button class=${b.variant ?? ''} @click=${() => this.clickBtn(b)}>${b.label}</button>
Expand Down
6 changes: 3 additions & 3 deletions dashboard/src/components/nv-onboarding.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,7 @@ const STEPS: TourStep[] = [
This 60-second tour walks you through the four panels, the App Store,
the Ghost Murmur research view, and the determinism contract that
makes nvsim distinctive.</p>
<p style="font-size:11.5px; color:var(--ink-3); line-height:1.5; margin-top:14px;">
<p style="font-size:11.5px; color:var(--ink-2); line-height:1.5; margin-top:14px;">
Press <kbd>Esc</kbd> any time to skip. You can replay this tour from
<b>Settings → Help</b>.</p>`,
cta: { label: 'Start the tour →' },
Expand Down Expand Up @@ -224,7 +224,7 @@ export class NvOnboarding extends LitElement {
.h .step-label {
font-family: var(--mono);
font-size: 10.5px;
color: var(--ink-3);
color: var(--ink-2);
margin-top: 4px;
text-transform: uppercase;
letter-spacing: 0.06em;
Expand Down Expand Up @@ -299,7 +299,7 @@ export class NvOnboarding extends LitElement {
.progress-label {
font-family: var(--mono);
font-size: 10px;
color: var(--ink-3);
color: var(--ink-2);
}
button.primary, button.ghost {
padding: 9px 16px;
Expand Down
4 changes: 2 additions & 2 deletions dashboard/src/components/nv-settings-drawer.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -172,7 +172,7 @@ export class NvSettingsDrawer extends LitElement {
<div class="desc">Stops the rotating diamond, animated field lines, and chart easing. Auto-on if your system has the prefers-reduced-motion preference set.</div>
</div>
<span class="toggle ${motionReduced.value ? 'on' : ''}"
role="switch" aria-checked=${motionReduced.value}
role="switch" aria-checked=${motionReduced.value} aria-label="Reduce motion"
@click=${() => motionReduced.value = !motionReduced.value}></span>
</div>
</div>
Expand All @@ -185,7 +185,7 @@ export class NvSettingsDrawer extends LitElement {
<div class="desc">When you change a Tunables slider or load a new scene, push the change to the worker without a manual restart.</div>
</div>
<span class="toggle ${autoUpdate.value ? 'on' : ''}"
role="switch" aria-checked=${autoUpdate.value}
role="switch" aria-checked=${autoUpdate.value} aria-label="Auto-rerun on edit"
@click=${() => autoUpdate.value = !autoUpdate.value}></span>
</div>
</div>
Expand Down
Loading