From 04709eadf00caab3538d17d38c9b1124d2018461 Mon Sep 17 00:00:00 2001 From: xiaolai Date: Wed, 29 Apr 2026 09:09:54 +0800 Subject: [PATCH] security: use JSON.stringify for selector escaping in devtools panel (#93) The inspectElement function previously used manual replace() chains to escape backslashes and single quotes in CSS selectors before passing them to chrome.devtools.inspectedWindow.eval(). This escaping was incomplete: selectors containing crafted sequences of special characters (backticks, newlines, Unicode escapes) could break out of the string literal and inject arbitrary JS into the inspected page context. JSON.stringify produces a properly escaped JS string literal that handles all special characters, eliminating the injection surface entirely. --- extension/devtools/panel.js | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/extension/devtools/panel.js b/extension/devtools/panel.js index ff567ae25..57013a646 100644 --- a/extension/devtools/panel.js +++ b/extension/devtools/panel.js @@ -501,10 +501,10 @@ function renderFindings(findings) { } function inspectElement(selector) { - const escaped = selector.replace(/\\/g, '\\\\').replace(/'/g, "\\'"); + const json = JSON.stringify(selector); chrome.devtools.inspectedWindow.eval( `(function() { - var el = document.querySelector('${escaped}'); + var el = document.querySelector(${json}); if (el) { el.scrollIntoView({ behavior: 'smooth', block: 'center' }); inspect(el); } })()` );