From 227ede1ef952d5922a1c1ad0f936c61816d80e2f Mon Sep 17 00:00:00 2001 From: Jenny Ferries Date: Tue, 28 Jul 2026 20:50:59 -0700 Subject: [PATCH] daily-focus-board: harden canvas (DNS-rebind, XSS, destructive write) + skill a11y Resolves the remaining Copilot review comments. Canvas extension (board-core.mjs, board.html): - DNS-rebinding: pin the Host header to the exact 127.0.0.1: authority and require a per-server capability token (minted at startup, embedded in the served page, sent as x-board-token) on ALL /api/* routes -- so GET /api/state can't leak task data and POSTs can't be forged. Mirrors extensions/signals-dashboard. - Destructive write: loadDoc only synthesizes a fresh board for ENOENT and now propagates I/O + JSON parse errors, so a transient/malformed state file is never overwritten by a later mutation. - XSS: escape emoji (from the seed / add_task action) at render, like title/unit. Skill (board.template.html, sample-board.html): - a11y: each task card gets role=group + aria-label so screen readers get task context. - counters: step=1 on the goal/update number inputs to match the positive-integer contract. Verified headless (35/35): token gates reads+writes, CSRF + foreign-Host refused, malformed file left intact. Repo plugin + skill validation green. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: cb356aa8-0af2-48f3-b3c6-8086c69d5308 --- .../daily-focus-board/assets/board.html | 17 +++-- extensions/daily-focus-board/board-core.mjs | 66 ++++++++++++++++--- .../assets/board.template.html | 5 +- .../examples/sample-board.html | 5 +- 4 files changed, 74 insertions(+), 19 deletions(-) diff --git a/extensions/daily-focus-board/assets/board.html b/extensions/daily-focus-board/assets/board.html index 5c471509..d41474ff 100644 --- a/extensions/daily-focus-board/assets/board.html +++ b/extensions/daily-focus-board/assets/board.html @@ -3,6 +3,7 @@ + Daily Focus Board · let's go 🔥