steve/att-consent
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Security hardening and accessibility improvements (v1.1.0)

Browse Source 
Address findings from security audit: wrap inline JSON.parse in
try/catch to prevent consent flow failure on corrupted cookies,
allowlist admin tab parameter, clamp consent_expiry server-side,
escape all server values in admin JS table builder, fix focus trap
listener cleanup, add aria-labelledby and banner focus for screen
readers, skip frontend loading during AJAX.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Steve Hanlon
2026-02-18 10:32:16 +00:00
parent 0a73181ea7
commit 2294c8eda7
7 changed files with 146 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
admin/js/admin.js
View File

@@ -131,22 +131,21 @@
return;
}
var categoryColors = {
functional: 'functional',
analytics: 'analytics',
marketing: 'marketing',
};
scripts.forEach(function(s) {
var row = '<tr data-id="' + s.id + '">' +
var eCat = escapeHtml(s.category);
var eStatus = escapeHtml(s.status);
var ePlacement = escapeHtml(s.placement);
var ePriority = escapeHtml(String(s.priority));
var eId = escapeHtml(String(s.id));
var row = '<tr data-id="' + eId + '">' +
'<td class="column-name">' + escapeHtml(s.name) + '</td>' +
'<td class="column-category"><span class="att-cc-badge att-cc-badge--' + s.category + '">' + capitalize(s.category) + '</span></td>' +
'<td class="column-placement">' + capitalize(s.placement) + '</td>' +
'<td class="column-priority">' + s.priority + '</td>' +
'<td class="column-status"><span class="att-cc-status att-cc-status--' + s.status + '">' + capitalize(s.status) + '</span></td>' +
'<td class="column-category"><span class="att-cc-badge att-cc-badge--' + eCat + '">' + capitalize(eCat) + '</span></td>' +
'<td class="column-placement">' + capitalize(ePlacement) + '</td>' +
'<td class="column-priority">' + ePriority + '</td>' +
'<td class="column-status"><span class="att-cc-status att-cc-status--' + eStatus + '">' + capitalize(eStatus) + '</span></td>' +
'<td class="column-actions">' +
'<button type="button" class="button button-small att-cc-edit-script" data-id="' + s.id + '">Edit</button> ' +
'<button type="button" class="button button-small button-link-delete att-cc-delete-script" data-id="' + s.id + '">Delete</button>' +
'<button type="button" class="button button-small att-cc-edit-script" data-id="' + eId + '">Edit</button> ' +
'<button type="button" class="button button-small button-link-delete att-cc-delete-script" data-id="' + eId + '">Delete</button>' +
'</td>' +
'</tr>';
$tbody.append(row);