fix: improve sanitation of toasts that bypass HTML escaping (#5540) * fix: improve sanitation of toasts that bypass HTML escaping * fix: replace absolute lib.js import with relative Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

2e4ca3dabf6503451587f1c28387e742e08ea60c

Cohee <18619528+Cohee1207@users.noreply.github.com>

Signed

public/scripts/action-loader-slashcommands.js+3 -2 Viewed

 import { SlashCommandEnumValue, enumTypes } from './slash-commands/SlashCommandEnumValue.js';
 import { SlashCommandParser } from './slash-commands/SlashCommandParser.js';
 import { isFalseBoolean } from './utils.js';
 +import { DOMPurify } from '../lib.js';
 /**
  * Registers slash commands for the action loader module.

                 slug: typeof args.slug === 'string' ? String(args.slug) : 'slash-show',
                 blocking,
                 toastMode,
 -                message,
 +                message: DOMPurify.sanitize(message),
 -                title,
 +                title: DOMPurify.sanitize(title),
                 stopTooltip,
                 onStop: createClosureHandler(args.onStop),
                 onHide: createClosureHandler(args.onHide, { argName: 'onHide' }),

public/scripts/extensions/regex/index.js+1 -1 Viewed

 function notifyReloadCurrentChat(presetName) {
     toastr.info(
         t`Reload the chat for regex to take effect` + '<br><u>' + t`Click here to reload immediately` + '</u>',
         t`Preset '${escapeHtml(presetName)}' contains enabled regex scripts`,
+        {
             timeOut: 5000,
             escapeHtml: false,

public/scripts/personas.js+6 -4 Viewed

     uuidv4,
     resolveAvatarData,
     findPersona,
 +    escapeHtml,
 } from './utils.js';
 import { debounce_timeout } from './constants.js';
 import { FILTER_TYPES, FilterHelper } from './filters.js';

             const temporary = getPersonaTemporaryLockInfo();
             if (temporary.isTemporary) {
                 toastr.info(t`This persona is only temporarily chosen. Click for more info.`, t`Temporary Persona`, {
                     preventDuplicates: true, onclick: () => {
 -                        toastr.info(temporary.info.replaceAll('\n', '<br />'), t`Temporary Persona`, { escapeHtml: false });
 +                    onclick: () => {
 +                        toastr.info(escapeHtml(temporary.info).replaceAll('\n', '<br />'), t`Temporary Persona`, { escapeHtml: false });
                     },
                 });
+            }

@@ -1116,9 +1118,9 @@ async function lockPersona(type = 'chat') {
1116	1118	if (power_user.persona_show_notifications) {
1117	1119	let additional = '';
1118	1120	if (unlinkedCharacters.length)
1119	1121	additional += `<br /><br />${t`Unlinked existing persona${unlinkedCharacters.length > 1 ? 's' : ''}: ${unlinkedCharacters.map(escapeHtml).join(', ')}`}`;
1120	1122	if (additional \|\| !isPersonaPanelOpen()) {
1121	1123	toastr.success(t`User persona ${escapeHtml(name1)} is locked to character ${escapeHtml(name2)}${additional}`, t`Persona Locked`, { escapeHtml: false });
1122	1124	}
1123	1125	}
1124	1126	}

public/scripts/tags.js+5 -4 Viewed

 import { FILTER_TYPES, FILTER_STATES, DEFAULT_FILTER_STATE, isFilterState, FilterHelper } from './filters.js';
 import { groupCandidatesFilter, groupMembersFilter, groups, selected_group } from './group-chats.js';
 import { download, onlyUnique, parseJsonFile, uuidv4, getSortableDelay, flashHighlight, equalsIgnoreCaseAndAccents, includesIgnoreCaseAndAccents, removeFromArray, getFreeName, debounce, findChar, escapeHtml } from './utils.js';
 import { power_user } from './power-user.js';
 import { SlashCommandParser } from './slash-commands/SlashCommandParser.js';
 import { SlashCommand } from './slash-commands/SlashCommand.js';

     const tagsToImport = tagNamesToImport.map(tag => getTag(tag, { createNew: true }));
     const added = addTagsToEntity(tagsToImport, character.avatar);
 +    const tagNames = tagsToImport.map(x => escapeHtml(x.name)).join(', ');
     if (added) {
         toastr.success(t`Imported tags:` + `<br />${tagsToImport.map(x => x.name).join(', ')tagNames}`, t`Importing Tags`, { escapeHtml: false });
     } else {
         toastr.error(t`Couldn't import tags:` + `<br />${tagsToImport.map(x => x.name).join(', ')tagNames}`, t`Importing Tags`, { escapeHtml: false });
+    }
     return added;

 function createNewTag(tagName) {
     const existing = getTag(tagName);
     if (existing) {
         toastr.warning(`Cannot create new tag. A tag with the name already exists:<br />${escapeHtml(existing.name)}`, 'Creating Tag', { escapeHtml: false });
         return existing;
+    }

public/scripts/utils.js+3 -3 Viewed

         return true;
+    }
     const overwrite = interactive && await Popup.show.confirm(`${type} ${actionName}`, `<p>A ${type.toLowerCase()} with the same name already exists:<br />${escapeHtml(existing)}</p>Do you want to overwrite it?`);
     if (!overwrite) {
         toastr.warning(`${type} ${actionName.toLowerCase()} cancelled. A ${type.toLowerCase()} with the same name already exists:<br />${escapeHtml(existing)}`, `${type} ${actionName}`, { escapeHtml: false });
         return false;
+    }
     toastr.info(`Overwriting Existing ${type}:<br />${escapeHtml(existing)}`, `${type} ${actionName}`, { escapeHtml: false });
     // If there is an action to delete the existing data, do it, as the name might be slightly different so file name would not be the same
     if (deleteAction) {