Webview XSS hardening: HTML/attribute escaping for untrusted sinks, URL scheme guard, safe code-block restore, regression test suites

[leonidasbarkas98-cpu]

Hardens the chat webview against HTML/JS injection from every sink we identified that renders user-, model- or third-party-controlled text, plus a few directly related correctness fixes and the test infrastructure to keep those sinks closed. Context for severity: the webview CSP is default-src * 'unsafe-inline' 'unsafe-eval', so anything that reaches innerHTML unescaped executes. Grouped thematically, roughly in commit order:

• Message rendering escapes prose, not just code fences. parseSimpleMarkdown escaped fenced code blocks but passed prose and inline-code content through unescaped into innerHTML, so a literal HTML tag in a response — e.g. a <select> Claude wrote outside a code fence — was parsed as real markup, and an unbalanced tag broke that message and everything after it. Text is now escaped right after code blocks are pulled into placeholders and before inline markup is applied. The conversation-history list had the same gap for user-message previews; those are escaped after truncation so entities are never cut apart.
• MCP server display and edit path. displayMCPServers() interpolated the server command/args/url/type straight into innerHTML, and the server name into an inline handler — onclick="editMCPServer('${name}', ...)" — with the whole config object alongside as JSON in the attribute. All of these can come from external ~/.claude.json/.mcp.json data (e.g. a cloned workspace's own .mcp.json); a single quote in a name broke out of the call, a double quote out of the attribute. Display values are now escaped, the config object never touches an attribute anymore (a per-render map is looked up by name instead), and name/scope travel via data-* + this.dataset. The display-escaping half matches upstream commit f759a955; that commit's unrelated Windows spawn-quoting and CLI-scope changes belong to a separate PR in this series and are not included here.
• Attribute sinks get their own escaper. escapeHtml only escapes & < >, so every attribute built with it stayed open to a " breakout: formatToolInputUI({file_path: 'a" onmouseover="alert(1)" zz="'}) produced a real onmouseover attribute on the emitted span — and file_path is model-generated tool input. A new escapeAttr in a self-contained src/html-escape.ts (spliced into the webview via .toString()) now covers all attribute sinks in script.ts, skills-script.ts and plugins-script.ts; inline handlers that interpolated values (open-file, plan actions, MCP edit) move to the data-* + dataset pattern. That conversion also fixes pre-existing plain bugs at those call sites: a path containing an apostrophe broke the handler syntactically, and backslashes were never escaped, so C:\tmp\a.txt reached the handler with \t expanded to a tab.
• Permissions list Remove button actually works again. The always-allow list interpolated tool name and command into an inline onclick through escapeHtml, which leaves ', " and \ untouched — practically every Windows path pattern (python "C:\Users\..." *) broke the attribute or the JS string literal, so clicking Remove silently did nothing. Values now travel via data-tool/data-command + dataset, which also hands the extension the exact raw string its removal filter compares against; the displayed name/command are escaped too. Verified manually for names and commands containing quotes and backslashes.
• Third-party data and URL schemes. Model id/name/provider from the models API are written into data attributes and card markup with no user interaction (the extension overwrites the bundled model list with API values and the webview re-renders) — a model name of <img src=x onerror=...> produced a live element. Escaped now. href/src values from the open MCP registries were escaped but their scheme was never checked, so "url": "javascript:..." passed through verbatim; a new safeHttpUrl() allows only http:/https: (strips tab/CR/LF and leading control characters first, compares the scheme case-insensitively), and callers omit the attribute entirely instead of emitting a dead one. Also fixed: an env-var row value containing " was truncated by an unescaped value="...".
• Copy/restore correctness. copyCodeBlock decoded entities a second time by hand after getAttribute had already decoded them, so code containing literal entity text (" etc.) came out of the clipboard mangled — the manual decode is dropped, with the invariant (exactly one attribute writer, all callers pass raw text) checked over 19 inputs including CRLF, Unicode, NUL and 200k-character payloads. Dead createExpandableInput (upstream 73c4a38: no caller, and a hand-written escaper that missed &) is removed — a future upstream merge will conflict at that spot. Separately, the code-block placeholder restore used String.prototype.replace(placeholder, htmlString), which interprets $&/$`/$'/$$ in the replacement as substitution patterns — a code block containing one of these could splice already-rendered HTML across block boundaries. The restore loop moved into src/markdown-restore.ts with a function replacer (literal substitution), plus a full-pipeline regression test through both call sites.
• Your own messages render as raw text. User messages went through the markdown renderer, so asterisks/underscores/backticks in a prompt were rendered away — src/_test_.ts came back italicised. They now render escaped with white-space: pre-wrap; fenced code blocks are the one intentional exception (keeping language label, copy button and collapse), via a shared extractCodeBlocks() instead of a second implementation. The refactor was verified as a pure move: 28 targeted plus 4000 random inputs produce byte-identical parseSimpleMarkdown output before and after, and 6000 adversarial payloads through the user path produce no tag or attribute outside the fixed code-block vocabulary.
• Collapsible long code blocks (a small feature the raw-text work builds on): fenced blocks over a configurable line threshold (default 20; new claudeCodeChat.ui.collapseLongCodeBlocks/.collapseCodeBlockLines settings) render as native <details>/<summary> with language and line count in the header, shorter blocks keep byte-identical markup, and every message gets a manual fold button independent of the auto-collapse.
• YOLO-mode correctness. script.ts declared enableYoloMode twice in the same scope; the surviving declaration dereferenced an undefined menu element on the argument-less inline chat button, which died with a TypeError — consolidated into one function (verified manually). Worse, the chat reported "YOLO Mode enabled!" purely client-side, before and regardless of whether the setting was actually persisted — in a window with no workspace folder the write threw and a bare catch swallowed it. The workspace-then-global write decision now lives in a pure, vscode-free src/settings-batch.ts, and success is only reported after the write went through; failures log, show a VS Code error message and notify the webview instead of vanishing.
• Settings saves no longer fail as a block. _updateSettings looped over keys under one outer try/catch, so one failing key silently discarded every subsequent key and skipped resending settings to the webview; each key now has its own try/catch.
• Test infrastructure. Six new plain-mocha suites (each with its own npm run test:<name> script) run the emitted getScript() output in a Node vm sandbox and parse the resulting DOM with parse5; each injection test was verified to fail against the previous code. The brace-counting helper that extracted webview functions for the sandbox didn't understand regex literals and silently extracted a wrong 2727-character chunk; it now asks the TypeScript compiler API (already a devDependency) for the declaration span, with shared DOM helpers deduplicated into src/test/webview-dom-helpers.ts. Full unit run at this tip: 131 passing, 0 failing (97 across the six new suites, plus the 34 pre-existing downloader/model-updater unit tests).

The remaining chore commits translate internal review comments to English, requalify bare issue references in code comments as fork-issue-NN so GitHub doesn't auto-link them to unrelated issues on this repository (genuine upstream references are kept), and fix stale cross-references in comments — no production logic.

This is one of several PRs from our fork submitted together as part of a broader, thematically grouped series (permission/session handling, settings/UI, security hardening, rendering, etc. split across separate branches/PRs). This is the security-hardening branch of that series; it is based directly on current main (ab6e307) and does not stack on any other PR in the series. Note: src/markdown-restore.ts (introduced here) also appears independently, with slightly different content, in the LaTeX/KaTeX rendering PR of this series — a merge conflict is expected if both are merged, as noted there.

tsc --noEmit clean. No new runtime dependencies; parse5 (used only by the new DOM-parsing tests) was previously available transitively via @vscode/vsce → cheerio and is now an explicit devDependency so the build fails loudly if it ever disappears.

🤖 Generated with Claude Code