🛡️ Sentinel: [HIGH] Fix XSS in JSON injection

[AhmmedSamier]

🚨 Severity: HIGH
💡 Vulnerability: Cross-Site Scripting (XSS) via unescaped JSON injection and JSON corruption via regex substitution tokens in deeplens-view-provider.ts. If a workspace folder path contained <script> tags, it could lead to XSS. If it contained regex tokens like $&, the JSON string would be corrupted, causing the Webview to crash.
🎯 Impact: Attackers or malformed folder names could execute arbitrary scripts in the VS Code Webview context, or cause the search view to break due to syntax errors.
🔧 Fix:

• Sanitized JSON by escaping < to \u003c and > to \u003e.
• Used replacer functions in String.replace (() => workspaceFoldersJson) to safely replace variables without triggering regex token substitutions.
  ✅ Verification: Ran bun run test in vscode-extension, built the code, and verified the modifications using git diff.

---

PR created automatically by Jules for task 10553952102900393975 started by @AhmmedSamier

Summary by CodeRabbit

• Bug Fixes
  • Fixed a security vulnerability affecting HTML template data injection.
  • Prevented potentially unsafe characters in workspace and command-scope data from being interpreted as HTML or scripts.
  • Improved template replacement reliability for serialized data containing special characters.

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[coderabbitai]

📝 Walkthrough

Walkthrough

Webview HTML generation now escapes < and > in serialized workspace and slash-command data, uses callback-based placeholder replacement, and documents the vulnerability mitigation. test.js demonstrates the escaping and replacement behavior.

Changes

HTML JSON Injection Mitigation

Layer / File(s)	Summary
Escape and inject webview JSON safely vscode-extension/src/deeplens-view-provider.ts, test.js, .jules/sentinel.md	Webview JSON escapes < and > as \u003c and \u003e; placeholder replacement uses callbacks; the example and sentinel documentation cover the mitigation.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• AhmmedSamier/DeepLens#581: Updates the same webview JSON injection path with angle-bracket escaping and replacer callbacks.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: fixing a high-severity XSS issue caused by JSON injection.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch sentinel-fix-json-injection-xss-10553952102900393975

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (1)

test.js (1)

1-4: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Make this an assertion-based regression test.

console.log only demonstrates the output; it will not fail if escaping or replacer behavior regresses. Assert the rendered value, or at least assert that escaped \u003c/\u003e sequences are present and raw </script> is absent.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@test.js` around lines 1 - 4, Replace the console.log call with an
assertion-based check for the rendered result, using the existing
workspaceFoldersJson replacement flow. Verify the output contains the escaped
\u003c and \u003e sequences and does not contain raw </script>, so regressions
in escaping or replacement behavior fail the test.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@test.js`:
- Around line 1-4: Replace the console.log call with an assertion-based check
for the rendered result, using the existing workspaceFoldersJson replacement
flow. Verify the output contains the escaped \u003c and \u003e sequences and
does not contain raw </script>, so regressions in escaping or replacement
behavior fail the test.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: b830ae18-b65a-4b5a-95fc-689a21ced159

📥 Commits

Reviewing files that changed from the base of the PR and between 124aa21 and 94a4454.

📒 Files selected for processing (3)

• .jules/sentinel.md
• test.js
• vscode-extension/src/deeplens-view-provider.ts