From 9ce1809928c432a8718d081a12ca618e86da7b56 Mon Sep 17 00:00:00 2001
From: tianhao <tianhao@metona.dev>
Date: Tue, 16 Jun 2026 12:40:01 +0800
Subject: [PATCH] =?UTF-8?q?fix(#1):=20XSS=20=E2=80=94=20escapeHTML=20?=
 =?UTF-8?q?=E4=BF=9D=E6=8A=A4=20confirm/prompt=20=E6=A8=A1=E6=9D=BF?=
 =?UTF-8?q?=E4=B8=AD=E7=9A=84=E6=89=80=E6=9C=89=E7=94=A8=E6=88=B7=E8=BE=93?=
 =?UTF-8?q?=E5=85=A5?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 src/core.js | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/src/core.js b/src/core.js
index 2a7bbb6..39bbfc2 100644
--- a/src/core.js
+++ b/src/core.js
@@ -539,8 +539,8 @@ const _confirmHTML = (opts) => {
   const confirmColor = opts.confirmColor || '#10b981';
   const cancelColor = opts.cancelColor || '#6b7280';
   return _btnRow(`
-    <button class="met-confirm-btn" style="flex:1;padding:8px 16px;border:none;border-radius:6px;background:${confirmColor};color:white;cursor:pointer;font-size:13px">${confirmText}</button>
-    <button class="met-cancel-btn" style="flex:1;padding:8px 16px;border:none;border-radius:6px;background:${cancelColor};color:white;cursor:pointer;font-size:13px">${cancelText}</button>
+    <button class="met-confirm-btn" style="flex:1;padding:8px 16px;border:none;border-radius:6px;background:${confirmColor};color:white;cursor:pointer;font-size:13px">${escapeHTML(confirmText)}</button>
+    <button class="met-cancel-btn" style="flex:1;padding:8px 16px;border:none;border-radius:6px;background:${cancelColor};color:white;cursor:pointer;font-size:13px">${escapeHTML(cancelText)}</button>
   `);
 };
 
@@ -557,12 +557,12 @@ const _promptHTML = (opts) => {
   return `
     <input type="${opts.inputType || 'text'}" 
            class="met-input" 
-           placeholder="${opts.placeholder || ''}"
-           value="${opts.defaultValue || ''}"
+           placeholder="${escapeHTML(opts.placeholder || '')}"
+           value="${escapeHTML(opts.defaultValue || '')}"
            style="width:100%;padding:8px 12px;border:1px solid rgba(0,0,0,0.1);border-radius:6px;font-size:13px;margin-top:8px;background:transparent;color:inherit;box-sizing:border-box">
     ${_btnRow(`
-      <button class="met-submit-btn" style="flex:1;padding:8px 16px;border:none;border-radius:6px;background:${submitColor};color:white;cursor:pointer;font-size:13px">${submitText}</button>
-      <button class="met-cancel-btn" style="flex:1;padding:8px 16px;border:none;border-radius:6px;background:${cancelColor};color:white;cursor:pointer;font-size:13px">${cancelText}</button>
+      <button class="met-submit-btn" style="flex:1;padding:8px 16px;border:none;border-radius:6px;background:${submitColor};color:white;cursor:pointer;font-size:13px">${escapeHTML(submitText)}</button>
+      <button class="met-cancel-btn" style="flex:1;padding:8px 16px;border:none;border-radius:6px;background:${cancelColor};color:white;cursor:pointer;font-size:13px">${escapeHTML(cancelText)}</button>
     `)}
   `;
 };