David/HERMES-GIELIE
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
HERMES-GIELIE/static
History
nesquena-hermes e4152c0398 fix(extensions): render skin picker label via textContent, not innerHTML (XSS hardening) 
Codex flagged that _buildSkinPicker injected the extension-controlled skin
label/name via btn.innerHTML, so a malicious registerHermesSkin descriptor
(label='<img src=x onerror=...>') could execute when Settings -> Appearance
builds the picker. Rebuild the button with DOM nodes + textContent for the
label and set swatch backgrounds via element.style.background. Adds regression
tests asserting the innerHTML sink is gone.
2026-06-28 05:22:26 +00:00
..
vendor fix: protect pipes inside backtick code spans in renderMd tables 2026-06-25 08:25:58 +00:00
apple-touch-icon.png feature: add manifest and icons to enable app install on android 2026-05-02 19:06:39 +02:00
assistant_turn_anchors.js Add assistant turn anchor renderer snapshot adapter 2026-06-14 02:03:45 +08:00
boot.js fix(extensions): render skin picker label via textContent, not innerHTML (XSS hardening) 2026-06-28 05:22:26 +00:00
commands.js fix(steer): rename typo, catch retry rejection, update JSDoc (#4749) 2026-06-25 03:23:36 +00:00
favicon-32.png fix: add favicon (SVG + PNG + ICO), fix static MIME types (#613) 2026-04-16 20:11:02 -07:00
favicon-192.png feature: add manifest and icons to enable app install on android 2026-05-02 19:06:39 +02:00
favicon-512.png feature: add manifest and icons to enable app install on android 2026-05-02 19:06:39 +02:00
favicon-512.svg feature: add manifest and icons to enable app install on android 2026-05-02 19:06:39 +02:00
favicon.ico fix: add favicon (SVG + PNG + ICO), fix static MIME types (#613) 2026-04-16 20:11:02 -07:00
favicon.svg fix: add favicon (SVG + PNG + ICO), fix static MIME types (#613) 2026-04-16 20:11:02 -07:00
i18n.js Merge current master into extension gallery source permissions 2026-06-28 13:05:12 +08:00
icons.js stage #4581 onto master (v0.51.556) — surface escape-target symlinks as display-only workspace rows 2026-06-21 09:15:22 +00:00
index.html theme-registration: preserve pending ext skin across reload + expand accent token allowlist 2026-06-28 05:22:26 +00:00
login.js feat: add passkey sign-in 2026-05-25 00:14:38 +00:00
manifest.json Stage 405: PR #2842 — feat: polish installed PWA startup by @AJV20 2026-05-24 18:28:52 +00:00
messages.js feat(moa): route /moa through WebUI via server-resolved MoA config (#5070, #5057) 2026-06-28 00:23:51 +00:00
onboarding.js fix(onboarding): rehydrate plain-select fallback so saved model isn't reset to option[0] 2026-06-27 04:33:02 +00:00
outline.js fix(outline): keep outline valid on the todos sidebar panel (Opus follow-up) 2026-06-10 23:55:05 +00:00
panels.js Merge current master into extension gallery source permissions 2026-06-28 13:05:12 +08:00
pwa-startup.js Stage 405: PR #2842 — feat: polish installed PWA startup by @AJV20 2026-05-24 18:28:52 +00:00
sessions.js fix(boot): preserve typed composer input during saved-session boot restore (#5069) 2026-06-27 20:51:46 +00:00
style.css Improve extension gallery source and permissions display 2026-06-28 12:44:57 +08:00
sw.js fix: focus the existing chat tab when a notification is clicked instead of opening a new tab 2026-06-13 14:42:41 -07:00
terminal.js fix(#4313): guard EventSource.close() calls to suppress ERR_ABORTED noise 2026-06-18 17:25:18 +00:00
ui.js feat(settings): sync a Hermes Dashboard chip with Appearance dropdown (#4936) 2026-06-27 20:33:51 +00:00
workspace.js docs(workspace): clarify redirect401 401 contract (#5001) 2026-06-26 22:09:09 +00:00