- 
+ ${qrCode ? `})
` : ''}
Scan with your authenticator app, or enter manually:
- ${setup.secret}
+ ${esc(setup.secret)}
diff --git a/static/js/signature.js b/static/js/signature.js
index 36780f7..94f8dfe 100644
--- a/static/js/signature.js
+++ b/static/js/signature.js
@@ -14,6 +14,20 @@
const API_BASE = window.location.origin;
+function _esc(s) {
+ return String(s ?? '')
+ .replace(/&/g, '&')
+ .replace(//g, '>')
+ .replace(/"/g, '"')
+ .replace(/'/g, ''');
+}
+
+function _safeSignatureDataUrl(raw) {
+ const value = String(raw || '').trim();
+ return /^data:image\/(?:png|jpe?g);base64,[a-z0-9+/=\s]+$/i.test(value) ? value : '';
+}
+
// Last signature the user picked or created in this session. Lets the export
// modal pre-fill subsequent signature fields with the same one — sign once,
// applies everywhere.
@@ -446,13 +460,17 @@ export function capture(opts = {}) {
export function pick(opts = {}) {
return new Promise(async (resolve) => {
const sigs = await _listSignatures();
- const tiles = sigs.map((s) => `
-
- 
-
-
+ const tiles = sigs.map((s) => {
+ const dataUrl = _safeSignatureDataUrl(s.data_url);
+ if (!dataUrl) return '';
+ return `
+
+ })
+
+
- `).join('');
+ `;
+ }).join('');
const overlay = _modal(`
@@ -477,7 +495,9 @@ export function pick(opts = {}) {
const id = tile.dataset.id;
const s = sigs.find((x) => x.id === id);
if (s) {
- const out = { id: s.id, dataUrl: s.data_url, width: s.width, height: s.height, name: s.name };
+ const dataUrl = _safeSignatureDataUrl(s.data_url);
+ if (!dataUrl) return;
+ const out = { id: s.id, dataUrl, width: s.width, height: s.height, name: s.name };
setLastUsed(out);
close(out);
}
diff --git a/tests/test_notes_dom_xss_helpers.py b/tests/test_notes_dom_xss_helpers.py
new file mode 100644
index 0000000..92e5d3d
--- /dev/null
+++ b/tests/test_notes_dom_xss_helpers.py
@@ -0,0 +1,34 @@
+"""Regression guards for Notes DOM rendering helpers."""
+
+from pathlib import Path
+
+
+_REPO = Path(__file__).resolve().parent.parent
+
+
+def test_notes_image_src_guard_rejects_script_capable_data_images():
+ src = (_REPO / "static" / "js" / "notes.js").read_text(encoding="utf-8")
+
+ assert "function _safeImgSrc(s)" in src
+ assert r"^data:image\/(?:png|jpe?g|gif|webp);base64," in src
+ assert r"^data:image\/i.test(v)" not in src
+
+
+def test_notes_linkify_escapes_href_attribute():
+ src = (_REPO / "static" / "js" / "notes.js").read_text(encoding="utf-8")
+
+ assert "function _attrEsc(s)" in src
+ assert 'href="${_attrEsc(href)}"' in src
+ assert 'href="${href}"' not in src
+
+
+def test_notes_edit_form_uses_safe_image_src_guard():
+ src = (_REPO / "static" / "js" / "notes.js").read_text(encoding="utf-8")
+
+ assert "let currentImageUrl = _safeImgSrc(note?.image_url || '');" in src
+ assert "let _stashedDrawUrl = (type === 'draw') ? (_safeImgSrc(note?.image_url) || null) : null;" in src
+ assert "_wireCanvas(bodyEl, _stashedDrawUrl || currentImageUrl || _safeImgSrc(note?.image_url) || null)" in src
+ assert "_wireCanvas(form.querySelector('.note-form-body'), _safeImgSrc(note?.image_url) || null)" in src
+ assert "const safeInitialImageUrl = _safeImgSrc(initialImageUrl);" in src
+ assert "img.src = safeInitialImageUrl;" in src
+ assert "img.src = initialImageUrl;" not in src
diff --git a/tests/test_signature_settings_dom_xss.py b/tests/test_signature_settings_dom_xss.py
new file mode 100644
index 0000000..daa3388
--- /dev/null
+++ b/tests/test_signature_settings_dom_xss.py
@@ -0,0 +1,26 @@
+"""Regression guards for DOM attribute sinks in signature/settings UI."""
+
+from pathlib import Path
+
+
+_REPO = Path(__file__).resolve().parent.parent
+
+
+def test_signature_picker_allows_only_raster_data_urls():
+ src = (_REPO / "static" / "js" / "signature.js").read_text(encoding="utf-8")
+
+ assert "function _safeSignatureDataUrl(raw)" in src
+ assert r"^data:image\/(?:png|jpe?g);base64," in src
+ assert '' in src
+ assert 'dataUrl: s.data_url' not in src
+
+
+def test_settings_2fa_setup_escapes_secret_and_qr_src():
+ src = (_REPO / "static" / "js" / "settings.js").read_text(encoding="utf-8")
+
+ assert "function safeRasterDataUrl(raw)" in src
+ assert "const qrCode = safeRasterDataUrl(setup.qr_code);" in src
+ assert '${setup.secret}
" not in src