Files
@Bibo-dochex 128c7e7866 fix: remediate DOM-based XSS in PushTX
- Refactor renderMessage to return HTMLElement and accept Node content
- Add textMessage helper for plain-text messages
- Replace innerHTML assignments with replaceChildren + DOM APIs
- Stop reflecting raw network parameter in parseFragment error
- Convert provider-error HTML construction to ProviderErrorsError class
- Escape API-returned values in renderTxDetails via textContent
- Add restrictive CSP meta tag to index.html
- Rebuild website and single-file artifacts
- Regenerate SHA256SUMS
2026-08-31 12:20:20 -04:00

31 lines
1009 B
HTML

<!doctype html>
<html lang="en">
<head>
<meta charset="UTF-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
<meta
http-equiv="Content-Security-Policy"
content="default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; connect-src https://mempool.space https://blockstream.info; img-src 'none'; font-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'none';"
/>
<title>COLDCARD NFC Push TX</title>
</head>
<body>
<main class="pushtx" style="
font-family: system-ui, -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Oxygen, Ubuntu, Cantarell, 'Open Sans', 'Helvetica Neue', sans-serif;
max-width: 1024px;
margin: 5vh auto;
">
<h1 style="margin-bottom: 2rem;">COLDCARD NFC Push TX</h1>
<div>
<div class="pushtx-message-area"></div>
<div class="pushtx-details-area"></div>
</div>
<script type="module" src="/src/main.ts"></script>
</main>
</body>
</html>