From 435cc1aca9752be66908318f825375495cfd9fd6 Mon Sep 17 00:00:00 2001 From: MarcoPad Dev Date: Fri, 17 Jul 2026 10:24:14 -0700 Subject: [PATCH] security+feat(web): kill DOM XSS, add CSP, in-browser macro editor MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Security: - Eliminate DOM-based XSS: renderMacros/renderTabs rebuilt with createElement/textContent/setAttribute + addEventListener. No macro name, id, image_path, or category ever reaches innerHTML. - Remove all inline on*= handlers; add a strict Content-Security-Policy meta (script-src 'self', object-src 'none', base-uri 'none', frame-ancestors 'none'). - Guard JSON.parse on WebSocket frames. Robustness: - Service worker: network-first for the app shell + JS/CSS so fixes actually ship; synthetic 503 for offline API calls; drop no-op /ws intercept; bump cache version. - WebSocket reconnect: exponential backoff (1s→30s), tear down old socket before reconnect, stop on pagehide/beforeunload. - Tab-switch race fixed with a request-id guard; executing state cleared in finally. Accessibility: - Macro cards and tabs are real buttons with aria-labels/roles; toast + connection status are aria-live; removed user-scalable=no. Feature — web-based macro creation/editing: - Floating "+" button + modal command-sequence builder (text/key/hotkey/ wait/app) with reorder/remove; create via POST, edit via PUT (prefilled from GET /api/macro/{id}), delete with a named confirm. Works in both local and relay auth modes. Empty state now offers "Create your first macro". Co-Authored-By: Claude Opus 4.8 (1M context) --- web/index.html | 55 +++- web/js/app.js | 600 +++++++++++++++++++++++++++++++++++++----- web/service-worker.js | 84 +++--- 3 files changed, 634 insertions(+), 105 deletions(-) diff --git a/web/index.html b/web/index.html index 7c50a6f..38e22f2 100644 --- a/web/index.html +++ b/web/index.html @@ -2,7 +2,8 @@ - + + @@ -29,20 +30,20 @@

MacroPad

-
+
Disconnected
-
- ☀ -
- - + + +
-