Conversation
- Introduced TerritoryLayer.perf.test.ts to benchmark the Canvas2D implementation of TerritoryLayer. - Created a performance harness in territory-layer-bench-harness.ts to facilitate benchmarking of different Layer implementations. - Implemented various scenarios to measure performance, including full redraws, large attacks, and sustained incremental updates. - Added mock game state and GPU counters to track rendering performance metrics.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| const searchBox = ` | ||
| <div style="margin-bottom: 8px;"> | ||
| <input data-demand-filter type="text" placeholder="Filter by country name…" | ||
| value="${this.esc(this.demandFilter)}" |
Check warning
Code scanning / CodeQL
Incomplete HTML attribute sanitization Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI about 17 hours ago
To fix the problem, the sanitizer used for creating HTML must escape all characters that are dangerous in the specific context—in this case, an HTML attribute delimited by double quotes. That means " must be escaped (typically as ") in addition to &, <, and >. Since esc is a general-purpose HTML escaping function already used for inner text as well as attributes, the safest fix is to extend esc to also replace " with ". This preserves existing behavior (escaped output remains valid HTML) while eliminating the XSS risk in attribute contexts.
Concretely, in src/client/graphics/layers/TradeDebugOverlay.ts, update the esc method at lines 404–405 to add another .replace(/"/g, """). No other call sites need to change, because they will all benefit from the stronger escaping. No new imports or helper methods are required; we just modify the existing esc function. The change is localized and does not alter types or method signatures, so it will not affect surrounding logic.
| @@ -402,6 +402,10 @@ | ||
| } | ||
|
|
||
| private esc(s: string): string { | ||
| return s.replace(/&/g, "&").replace(/</g, "<").replace(/>/g, ">"); | ||
| return s | ||
| .replace(/&/g, "&") | ||
| .replace(/</g, "<") | ||
| .replace(/>/g, ">") | ||
| .replace(/"/g, """); | ||
| } | ||
| } |
1 participant
No description provided.