@frontmcp/uipack 1.7.2 → 1.8.0

package/adapters/base-template.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"base-template.d.ts","sourceRoot":"","sources":["../../src/adapters/base-template.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACzC,mCAAmC;IACnC,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,0BAA0B,GAAG,MAAM,CAoCrF"}
+{"version":3,"file":"base-template.d.ts","sourceRoot":"","sources":["../../src/adapters/base-template.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAMH;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACzC,mCAAmC;IACnC,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,0BAA0B,GAAG,MAAM,CA6CrF"}

package/adapters/index.js

@@ -2836,13 +2836,14 @@ function renderToolTemplate(options) {
 // libs/uipack/src/adapters/base-template.ts
 function createDefaultBaseTemplate(options) {
   const { toolName } = options;
+  const safeToolName = escapeHtml(toolName);
   const bridgeScript = `<script>${generateBridgeIIFE({ minify: true })}</script>`;
   const content = `
 ${bridgeScript}
 <div id="root">
   <div style="font-family:system-ui,sans-serif;padding:1rem;color:#374151;">
     <p style="color:#6b7280;font-size:0.875rem;">Waiting for tool output...</p>
-    <p style="color:#9ca3af;font-size:0.75rem;">Tool: <code>${toolName}</code></p>
+    <p style="color:#9ca3af;font-size:0.75rem;">Tool: <code>${safeToolName}</code></p>
   </div>
 </div>
 <script>
@@ -2852,9 +2853,13 @@ ${bridgeScript}
     bridge.onToolResult(function(data) {
       var root = document.getElementById('root');
       if (root && data) {
-        root.innerHTML = '<pre style="font-family:monospace;white-space:pre-wrap;padding:1rem;">' +
-          JSON.stringify(data, null, 2).replace(/</g, '&lt;').replace(/>/g, '&gt;') +
-          '</pre>';
+        // textContent, not innerHTML: the previous version escaped only < and >, leaving
+        // the rendered JSON wrong wherever the data contained an entity, and relying on a
+        // hand-rolled replace for safety (GHSA-rhr9-vhpf-jqp7).
+        var pre = document.createElement('pre');
+        pre.setAttribute('style', 'font-family:monospace;white-space:pre-wrap;padding:1rem;');
+        pre.textContent = JSON.stringify(data, null, 2);
+        root.replaceChildren(pre);
       }
     });
   }

package/esm/adapters/index.mjs

@@ -2804,13 +2804,14 @@ function renderToolTemplate(options) {
 // libs/uipack/src/adapters/base-template.ts
 function createDefaultBaseTemplate(options) {
   const { toolName } = options;
+  const safeToolName = escapeHtml(toolName);
   const bridgeScript = `<script>${generateBridgeIIFE({ minify: true })}</script>`;
   const content = `
 ${bridgeScript}
 <div id="root">
   <div style="font-family:system-ui,sans-serif;padding:1rem;color:#374151;">
     <p style="color:#6b7280;font-size:0.875rem;">Waiting for tool output...</p>
-    <p style="color:#9ca3af;font-size:0.75rem;">Tool: <code>${toolName}</code></p>
+    <p style="color:#9ca3af;font-size:0.75rem;">Tool: <code>${safeToolName}</code></p>
   </div>
 </div>
 <script>
@@ -2820,9 +2821,13 @@ ${bridgeScript}
     bridge.onToolResult(function(data) {
       var root = document.getElementById('root');
       if (root && data) {
-        root.innerHTML = '<pre style="font-family:monospace;white-space:pre-wrap;padding:1rem;">' +
-          JSON.stringify(data, null, 2).replace(/</g, '&lt;').replace(/>/g, '&gt;') +
-          '</pre>';
+        // textContent, not innerHTML: the previous version escaped only < and >, leaving
+        // the rendered JSON wrong wherever the data contained an entity, and relying on a
+        // hand-rolled replace for safety (GHSA-rhr9-vhpf-jqp7).
+        var pre = document.createElement('pre');
+        pre.setAttribute('style', 'font-family:monospace;white-space:pre-wrap;padding:1rem;');
+        pre.textContent = JSON.stringify(data, null, 2);
+        root.replaceChildren(pre);
       }
     });
   }

package/esm/index.mjs

@@ -4072,13 +4072,14 @@ function renderToolTemplate(options) {
 // libs/uipack/src/adapters/base-template.ts
 function createDefaultBaseTemplate(options) {
   const { toolName } = options;
+  const safeToolName = escapeHtml(toolName);
   const bridgeScript = `<script>${generateBridgeIIFE({ minify: true })}</script>`;
   const content = `
 ${bridgeScript}
 <div id="root">
   <div style="font-family:system-ui,sans-serif;padding:1rem;color:#374151;">
     <p style="color:#6b7280;font-size:0.875rem;">Waiting for tool output...</p>
-    <p style="color:#9ca3af;font-size:0.75rem;">Tool: <code>${toolName}</code></p>
+    <p style="color:#9ca3af;font-size:0.75rem;">Tool: <code>${safeToolName}</code></p>
   </div>
 </div>
 <script>
@@ -4088,9 +4089,13 @@ ${bridgeScript}
     bridge.onToolResult(function(data) {
       var root = document.getElementById('root');
       if (root && data) {
-        root.innerHTML = '<pre style="font-family:monospace;white-space:pre-wrap;padding:1rem;">' +
-          JSON.stringify(data, null, 2).replace(/</g, '&lt;').replace(/>/g, '&gt;') +
-          '</pre>';
+        // textContent, not innerHTML: the previous version escaped only < and >, leaving
+        // the rendered JSON wrong wherever the data contained an entity, and relying on a
+        // hand-rolled replace for safety (GHSA-rhr9-vhpf-jqp7).
+        var pre = document.createElement('pre');
+        pre.setAttribute('style', 'font-family:monospace;white-space:pre-wrap;padding:1rem;');
+        pre.textContent = JSON.stringify(data, null, 2);
+        root.replaceChildren(pre);
       }
     });
   }

package/esm/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontmcp/uipack",
-  "version": "1.7.2",
+  "version": "1.8.0",
   "description": "FrontMCP UIpack - HTML shell builder, pluggable import resolver, and NPM component loader for MCP UI (React-free core)",
   "author": "AgentFront <info@agentfront.dev>",
   "homepage": "https://docs.agentfront.dev",
@@ -61,6 +61,6 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@frontmcp/lazy-zod": "1.7.2"
+    "@frontmcp/lazy-zod": "1.8.0"
   }
 }

package/index.js

@@ -4189,13 +4189,14 @@ function renderToolTemplate(options) {
 // libs/uipack/src/adapters/base-template.ts
 function createDefaultBaseTemplate(options) {
   const { toolName } = options;
+  const safeToolName = escapeHtml(toolName);
   const bridgeScript = `<script>${generateBridgeIIFE({ minify: true })}</script>`;
   const content = `
 ${bridgeScript}
 <div id="root">
   <div style="font-family:system-ui,sans-serif;padding:1rem;color:#374151;">
     <p style="color:#6b7280;font-size:0.875rem;">Waiting for tool output...</p>
-    <p style="color:#9ca3af;font-size:0.75rem;">Tool: <code>${toolName}</code></p>
+    <p style="color:#9ca3af;font-size:0.75rem;">Tool: <code>${safeToolName}</code></p>
   </div>
 </div>
 <script>
@@ -4205,9 +4206,13 @@ ${bridgeScript}
     bridge.onToolResult(function(data) {
       var root = document.getElementById('root');
       if (root && data) {
-        root.innerHTML = '<pre style="font-family:monospace;white-space:pre-wrap;padding:1rem;">' +
-          JSON.stringify(data, null, 2).replace(/</g, '&lt;').replace(/>/g, '&gt;') +
-          '</pre>';
+        // textContent, not innerHTML: the previous version escaped only < and >, leaving
+        // the rendered JSON wrong wherever the data contained an entity, and relying on a
+        // hand-rolled replace for safety (GHSA-rhr9-vhpf-jqp7).
+        var pre = document.createElement('pre');
+        pre.setAttribute('style', 'font-family:monospace;white-space:pre-wrap;padding:1rem;');
+        pre.textContent = JSON.stringify(data, null, 2);
+        root.replaceChildren(pre);
       }
     });
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontmcp/uipack",
-  "version": "1.7.2",
+  "version": "1.8.0",
   "description": "FrontMCP UIpack - HTML shell builder, pluggable import resolver, and NPM component loader for MCP UI (React-free core)",
   "author": "AgentFront <info@agentfront.dev>",
   "homepage": "https://docs.agentfront.dev",
@@ -61,6 +61,6 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@frontmcp/lazy-zod": "1.7.2"
+    "@frontmcp/lazy-zod": "1.8.0"
   }
 }