David/HERMES-GIELIE
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge pull request #2255 into stage-355

Browse source 
[codex] Escape model picker display text (franksong2702, closes #2254)

# Conflicts:
#	CHANGELOG.md
This commit is contained in:
Hermes Agent 2026-05-14 15:13:41 +00:00
commit 1fbb2d6ce9
3 changed files with 23 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
static/panels.js
View file

@ -5569,7 +5569,7 @@ async function loadProvidersPanel(){
list.appendChild(_buildProviderCard(p));
}
}catch(e){
list.innerHTML='<div style="color:var(--error);padding:12px;font-size:13px">Failed to load providers: '+e.message+'</div>';
list.innerHTML='<div style="color:var(--error);padding:12px;font-size:13px">Failed to load providers: '+esc(e.message||String(e))+'</div>';
}
}

4
static/ui.js
View file

@ -1206,7 +1206,7 @@ function renderModelDropdown(){
}
}
const badgeHtml=m.badge?`<span class="model-opt-badge model-opt-badge--${esc(m.badge.role||'configured')}">${esc(badgeLabel)}</span>`:'';
row.innerHTML=`<div class="model-opt-top"><span class="model-opt-name">${esc(modelName)}</span>${badgeHtml}</div><span class="model-opt-id">${m.id}</span>`;
row.innerHTML=`<div class="model-opt-top"><span class="model-opt-name">${esc(modelName)}</span>${badgeHtml}</div><span class="model-opt-id">${esc(m.id)}</span>`;
row.onclick=()=>selectModelFromDropdown(m.value);
dd.appendChild(row);
}
@ -1234,7 +1234,7 @@ function renderModelDropdown(){
const badgeHtml=m.badge?`<span class="model-opt-badge model-opt-badge--${esc(m.badge.role||'configured')}">${esc(m.badge.label||'Configured')}</span>`:'';
// Inline provider chip on every row that has a group (#1425)
const providerChip=m.group?`<span class="model-opt-provider">${esc(m.group)}</span>`:'';
row.innerHTML=`<div class="model-opt-top"><span class="model-opt-name">${m.name}</span>${badgeHtml}${providerChip}</div><span class="model-opt-id">${m.id}</span>`;
row.innerHTML=`<div class="model-opt-top"><span class="model-opt-name">${esc(m.name)}</span>${badgeHtml}${providerChip}</div><span class="model-opt-id">${esc(m.id)}</span>`;
row.onclick=()=>selectModelFromDropdown(m.value);
dd.appendChild(row);
}

20
tests/test_model_picker_escaping.py Normal file
View file

@ -0,0 +1,20 @@
from pathlib import Path
ROOT = Path(__file__).resolve().parents[1]
def test_model_picker_escapes_provider_supplied_model_labels():
src = (ROOT / "static" / "ui.js").read_text()
assert '<span class="model-opt-id">${esc(m.id)}</span>' in src
assert '<span class="model-opt-name">${esc(m.name)}</span>' in src
assert '<span class="model-opt-id">${m.id}</span>' not in src
assert '<span class="model-opt-name">${m.name}</span>' not in src
def test_providers_panel_escapes_load_error_text():
src = (ROOT / "static" / "panels.js").read_text()
assert "Failed to load providers: '+esc(e.message||String(e))+'" in src
assert "Failed to load providers: '+e.message+'" not in src