Add Cloudflare Worker private navigation app (bookmarks, bg, weather) - #2
Add Cloudflare Worker private navigation app (bookmarks, bg, weather)#2omaler886 wants to merge 1 commit into
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 697a785bfa
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| a.href = item.url; | ||
| a.target = '_blank'; | ||
| a.rel = 'noreferrer'; | ||
| a.innerHTML = '<strong>' + item.title + '</strong><div style="opacity:.75;margin-top:6px;font-size:12px">' + item.url + '</div>'; |
There was a problem hiding this comment.
renderCards inserts item.title and item.url directly into a.innerHTML, but these values come from KV-backed bookmark data and are not sanitized. A crafted bookmark title like HTML with an event handler becomes persistent XSS that executes whenever the dashboard loads, allowing arbitrary script execution in the authenticated origin. Render untrusted fields with textContent/DOM nodes instead of concatenated HTML.
Useful? React with 👍 / 👎.
| } | ||
| if (request.method === 'POST') { | ||
| const body = await safeJson(request); | ||
| if (!Array.isArray(body?.bookmarks)) { |
There was a problem hiding this comment.
The POST /api/bookmarks handler only verifies that bookmarks is an array, so payloads like [null] are accepted and persisted. On the next read, renderCards dereferences item.url/item.title; a null element throws and breaks dashboard rendering until KV data is repaired. Add per-item validation (object with string title and string url) before writing to KV.
Useful? React with 👍 / 👎.
1 participant
Motivation
Description
worker.jswhich implements HTTP handlers forPOST /api/login,POST /api/logout,GET/POST /api/bookmarks,GET/POST /api/bg, andGET /api/weather, plus root pages for the login and main app UI.signValue(SHA-256) fromACCESS_PASSWORD, and KV storage is accessed via theNAV_KVbinding for bookmarks and background keys.worker.jsand provides UI for navigation/bookmarks, manual/auto background selection, and weather fetching; background auto-caching usesbg:auto:YYYY-MM-DDkeys andpicsum.photosas a default source.wrangler.tomlwithNAV_KVnamespace placeholder andREADME.mdwith deployment steps and KV key documentation.Testing
Codex Task