Affaan Mustafa a03d63cba0 fix(security): close XSS in control-pane board controls ... The interactive claim/move buttons concatenated work-item ids into inline onclick JS with only single-quote escaping — a crafted id (ids/titles come from GitHub sync and manual upserts, not a strict allowlist) could break out and inject script, even on the localhost-only server. Fix: emit the id/lane in HTML-escaped data-* attributes (escapeHtml encodes &<>"'), attach delegated click listeners that read them via getAttribute, and pass the raw value as a JS string arg — never concatenated into code. Adds a regression assertion that no inline onclick handlers with interpolated ids remain. Flagged by automated security review. Full suite 2845/2845; lint green.		2026-06-18 18:25:28 -04:00
..
auto-update.test.js	…
build-opencode.test.js	…
catalog.test.js	…
check-unicode-safety.test.js	test(ci): regression coverage for newly-covered invisible code points	2026-05-18 21:20:36 -04:00
claw.test.js	…
codex-hooks.test.js	fix: add plugin cache health check (#2249)	2026-06-15 14:01:25 -04:00
consult.test.js	…
control-pane.test.js	fix(security): close XSS in control-pane board controls	2026-06-18 18:25:28 -04:00
dashboard-web.test.js	feat: add web capabilities dashboard (#2100)	2026-06-15 14:01:16 -04:00
discussion-audit.test.js	chore: gate canonical ECC release identity (#1991)	2026-05-19 06:42:17 -04:00
doctor.test.js	…
ecc-dashboard.test.js	…
ecc.test.js	feat: add ECC2 local control pane (#2131)	2026-06-03 21:54:30 +08:00
gemini-adapt-agents.test.js	…
github-coordination.test.js	docs+chore: add README Security section; fix lint regressions on main	2026-06-16 02:08:14 -04:00
harness-audit.test.js	feat: extend harness audit integration scoring (#1990)	2026-05-19 06:20:54 -04:00
install-apply.test.js	feat(mcp): single-connector default set + connector policy (#2219)	2026-06-09 23:28:35 -04:00
install-plan.test.js	…
install-ps1.test.js	…
install-readme-clarity.test.js	…
install-sh.test.js	…
instinct-cli-projects.test.js	fix: surface legacy data warning in instinct-cli status (#2127)	2026-06-07 13:26:22 +08:00
list-installed.test.js	…
loop-status.test.js	…
manual-hook-install-docs.test.js	…
npm-publish-surface.test.js	fix: add plugin cache health check (#2249)	2026-06-15 14:01:25 -04:00
observability-readiness.test.js	…
openclaw-persona-forge-gacha.test.js	…
operator-readiness-dashboard.test.js	docs: sync live native payments gate evidence	2026-05-19 23:25:38 -04:00
orchestrate-codex-worker.test.js	…
orchestration-status.test.js	…
platform-audit.test.js	docs: sync selected-target announcement gate (#2020)	2026-05-19 22:09:45 -04:00
post-bash-command-log.test.js	…
preview-pack-smoke.test.js	Add preview pack smoke gate	2026-05-17 15:35:23 -04:00
release-approval-gate.test.js	Add release approval gate	2026-05-19 18:18:54 -04:00
release-publish.test.js	test: normalize release workflow line endings	2026-05-18 13:53:26 -04:00
release-video-suite.test.js	chore: refresh suite count evidence (#2000)	2026-05-19 09:58:53 -04:00
release.test.js	…
repair.test.js	test: stabilize repair lifecycle on Windows	2026-05-18 03:48:51 -04:00
session-inspect.test.js	…
setup-package-manager.test.js	…
skill-create-output.test.js	…
sync-ecc-to-codex.test.js	…
trae-install.test.js	Finalize and enhance SLSA generic generator workflow (#2197)	2026-06-15 14:01:29 -04:00
uninstall.test.js	…
work-items.test.js	feat(work-items): add 'claim' command for JIT work pickup	2026-06-18 17:07:24 -04:00