@aimeloic/monkey-tester 1.0.6 → 1.0.7

package/htmlTemplate.js

@@ -1,4 +1,5 @@
 export function getHtmlTemplate(endpoints) {
+  // Safe stringification for HTML attribute encoding
   const safeJsonString = Buffer.from(JSON.stringify(endpoints)).toString('base64');
 
   return `
@@ -148,13 +149,11 @@ function buildSidebar() {
   if (keys.length > 0) renderPanel(keys[0]);
 }
 
-function makeInput(type, id, placeholder, defaultValue) {
-  var el = document.createElement('input');
-  el.type = type;
-  el.id = id;
-  if (placeholder) el.placeholder = placeholder;
-  if (defaultValue !== undefined) el.value = defaultValue;
-  return el.outerHTML;
+// FIXED: Elements are explicitly assigned attributes to enforce string literal values cleanly
+function makeInputString(type, id, placeholder, defaultValue) {
+  const pAttr = placeholder ? ' placeholder="' + placeholder + '"' : '';
+  const vAttr = defaultValue !== undefined ? ' value=\'' + defaultValue + '\'' : '';
+  return '<input type="' + type + '" id="' + id + '"' + pAttr + vAttr + ' />';
 }
 
 function renderPanel(epKey) {
@@ -165,8 +164,8 @@ function renderPanel(epKey) {
 
   let html = '<div class="endpoint-title">' + ep.title + '</div>' +
     '<div class="endpoint-path">' +
-      '<span class="method-badge ' + ep.method + '">' + ep.method + '</span>' +
-      '<span>' + ep.path + '</span>' +
+    '  <span class="method-badge ' + ep.method + '">' + ep.method + '</span>' +
+    '  <span>' + ep.path + '</span>' +
     '</div>' +
     '<div class="endpoint-desc">' + ep.desc + '</div>';
 
@@ -174,8 +173,8 @@ function renderPanel(epKey) {
     html += '<div class="form-section"><div class="form-section-title">Path Parameters</div>';
     ep.params.forEach(function(p) {
       html += '<div class="field-row">' +
-        '<label class="field-label">' + p.label + '</label>' +
-        makeInput('text', 'param-' + p.name, p.placeholder, '') +
+        '  <label class="field-label">' + p.label + '</label>' +
+           makeInputString('text', 'param-' + p.name, p.placeholder, '') +
         '</div>';
     });
     html += '</div>';
@@ -185,16 +184,16 @@ function renderPanel(epKey) {
     html += '<div class="form-section"><div class="form-section-title">JSON Request Body Raw Payload</div>';
     ep.fields.forEach(function(f) {
       html += '<div class="field-row">' +
-        '<label class="field-label">' + f.label + '</label>' +
-        makeInput('text', 'field-' + f.name, '', '{"key": "value"}') +
+        '  <label class="field-label">' + f.label + '</label>' +
+           makeInputString('text', 'field-' + f.name, '', '{"key": "value"}') +
         '</div>';
     });
     html += '</div>';
   }
 
   html += '<div class="btn-row">' +
-    '<button class="btn" onclick="sendRequest()">Execute Route</button>' +
-    '<button class="btn btn-secondary" onclick="clearResponse()">Clear Context</button>' +
+    '  <button class="btn" onclick="sendRequest()">Execute Route</button>' +
+    '  <button class="btn btn-secondary" onclick="clearResponse()">Clear Context</button>' +
     '</div>';
 
   main.innerHTML = html;
@@ -212,7 +211,7 @@ async function sendRequest() {
     }
   }
 
-  const baseUrl = document.getElementById('base-url').value.replace(/\/+$/, '');
+  const baseUrl = document.getElementById('base-url').value.replace(/[/]+$/, '');
   const url = baseUrl + path;
   const headers = { 'Content-Type': 'application/json' };
 
@@ -274,7 +273,7 @@ function clearResponse() {
 
 function highlightJson(str) {
   return str
-    .replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;')
+    .replace(/&/g, '&amp;').replace(/[<]/g, '&lt;').replace(/[>]/g, '&gt;')
     .replace(/("(\\u[a-zA-Z0-9]{4}|\\[^u]|[^\\"])*"(\s*:)?|\b(true|false|null)\b|-?\d+(?:\.\d*)?(?:[eE][+\-]?\d+)?)/g, function(match) {
       if (/^"/.test(match)) {
         if (/:$/.test(match)) return '<span class="json-key">' + match + '</span>';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aimeloic/monkey-tester",
-  "version": "1.0.6",
+  "version": "1.0.7",
   "description": "Embedded interactive API testing UI for Node.js backends",
   "main": "index.js",
   "type":"module",