From c0352a07d294da015a72a842ae5b2ecad8d7ffcf Mon Sep 17 00:00:00 2001 From: admin-mf Date: Fri, 6 Mar 2026 00:03:26 -0600 Subject: [PATCH] security(launcher): HTML-escape error messages in auth callback Use html.EscapeString on all error text rendered in HTML responses to prevent XSS via crafted OAuth error parameters or error messages. Co-Authored-By: Claude Opus 4.6 --- cmd/picoclaw-launcher/internal/server/auth_handlers.go | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/cmd/picoclaw-launcher/internal/server/auth_handlers.go b/cmd/picoclaw-launcher/internal/server/auth_handlers.go index 3b48f9739..b4f58add9 100644 --- a/cmd/picoclaw-launcher/internal/server/auth_handlers.go +++ b/cmd/picoclaw-launcher/internal/server/auth_handlers.go @@ -3,6 +3,7 @@ package server import ( "encoding/json" "fmt" + "html" "io" "log" "net/http" @@ -237,7 +238,7 @@ func handleOAuthCallback(w http.ResponseWriter, r *http.Request) { fmt.Fprintf( w, `

Authentication failed

%s

You can close this window.

`, - errMsg, + html.EscapeString(errMsg), ) return } @@ -248,7 +249,7 @@ func handleOAuthCallback(w http.ResponseWriter, r *http.Request) { fmt.Fprintf( w, `

Authentication failed

%s

You can close this window.

`, - err.Error(), + html.EscapeString(err.Error()), ) return } @@ -267,7 +268,7 @@ func handleOAuthCallback(w http.ResponseWriter, r *http.Request) { if err := auth.SetCredential(session.Provider, cred); err != nil { w.Header().Set("Content-Type", "text/html") - fmt.Fprintf(w, `

Failed to save credentials

%s

`, err.Error()) + fmt.Fprintf(w, `

Failed to save credentials

%s

`, html.EscapeString(err.Error())) return }