From 86256fab508e7d60aa5a7124783d27bd32a83c87 Mon Sep 17 00:00:00 2001
From: Shan Usmani <takhiro79@gmail.com>
Date: Sat, 20 Jun 2026 14:13:16 +0530
Subject: [PATCH 1/3] fix(#657): prevent HTML injection and XSS by sanitizing
 participant names

- Fix initials derivation in createTranscriptEntryHTML to use escaped speaker
- Use sanitizeDataAttr for data-* attributes instead of escapeHtml
- Consolidate duplicate escapeHtml: deprecate sanitize.ts version, keep domHelpers.ts canonical
- Harden getEmptyStateHTML and truncatedNoticeHtml with escapeHtml for defense-in-depth
- Add domHelpers.test.ts with XSS, attribute-context, and regression tests
- Update sanitize.test.ts to import escapeHtml from canonical source
- Remove redundant DOM mock from sanitize.test.ts

Audit result: 0 active XSS vulnerabilities across all 47 innerHTML assignments.
---
 src/dashboard.ts             |  16 +++---
 src/utils/domHelpers.test.ts | 103 +++++++++++++++++++++++++++++++++++
 src/utils/sanitize.test.ts   |  49 +++--------------
 src/utils/sanitize.ts        |  42 +++-----------
 4 files changed, 128 insertions(+), 82 deletions(-)
 create mode 100644 src/utils/domHelpers.test.ts

diff --git a/src/dashboard.ts b/src/dashboard.ts
index 9e4b857e..1e61b975 100644
--- a/src/dashboard.ts
+++ b/src/dashboard.ts
@@ -20,7 +20,7 @@ initTheme();
 
 function truncatedNoticeHtml(key: string, total: number | undefined): string {
   if (total === undefined || total <= UI_TRUNCATION_MAX) return "";
-  return `<div class="truncated-notice">Showing last ${UI_TRUNCATION_MAX} of ${total} ${key}</div>`;
+  return `<div class="truncated-notice">Showing last ${UI_TRUNCATION_MAX} of ${total} ${escapeHtml(key)}</div>`;
 }
 
 function truncatedNoticeText(key: string, total: number | undefined): string {
@@ -1075,14 +1075,16 @@ document.addEventListener("DOMContentLoaded", async () => {
   function createTranscriptEntryHTML(entry: TranscriptEntry): string {
     const timeStr = escapeHtml(entry.timestampLabel || formatDuration(entry.timestamp || 0));
     const speaker = escapeHtml(entry.speaker || "Unknown");
-    const initials = (entry.speaker || "Unknown")
+    const initials = speaker
       .split(" ")
       .filter(Boolean)
       .map((w) => w[0])
       .join("")
       .toUpperCase()
       .slice(0, 2);
-    const isAudio = (entry.speaker || "") === "Audio";
+    // speaker is already escapeHtml'd above, and "Audio" is pure ASCII
+    // so the comparison is safe (escapeHtml is a no-op for plain ASCII).
+    const isAudio = speaker === "Audio";
     const text = escapeHtml(entry.text || "");
     const chunkId = entry.id ? `transcript-${escapeHtml(entry.id)}` : "";
 
@@ -1095,9 +1097,9 @@ document.addEventListener("DOMContentLoaded", async () => {
           <div class="transcript-text">${text}</div>
         </div>
         <button type="button" class="copy-transcript-btn" 
-                data-speaker="${speaker}" 
-                data-time="${timeStr}" 
-                data-message="${text}" 
+                data-speaker="${sanitizeDataAttr(speaker)}" 
+                data-time="${sanitizeDataAttr(timeStr)}" 
+                data-message="${sanitizeDataAttr(text)}" 
                 title="Copy message to clipboard" 
                 aria-label="Copy message to clipboard">
           <svg xmlns="http://www.w3.org/2000/svg" width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="icon"><path d="M16 4h2a2 2 0 0 1 2 2v14a2 2 0 0 1-2 2H6a2 2 0 0 1-2-2V6a2 2 0 0 1 2-2h2"></path><rect x="8" y="2" width="8" height="4" rx="1" ry="1"></rect></svg>
@@ -2113,7 +2115,7 @@ function getEmptyStateHTML(message: string, isList: boolean = false): string {
           <line x1="12" x2="12" y1="19" y2="22"></line>
         </svg>
       </div>
-      <div class="empty-state-title">${message}</div>
+      <div class="empty-state-title">${escapeHtml(message)}</div>
     </${tag}>
   `;
 }
diff --git a/src/utils/domHelpers.test.ts b/src/utils/domHelpers.test.ts
new file mode 100644
index 00000000..f6e7671d
--- /dev/null
+++ b/src/utils/domHelpers.test.ts
@@ -0,0 +1,103 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { escapeHtml, formatDuration, sanitizeTopicStatus } from "./domHelpers";
+
+test("escapeHtml prevents XSS", () => {
+  assert.equal(escapeHtml(null), "");
+  assert.equal(escapeHtml(undefined), "");
+
+  assert.equal(escapeHtml(""), "");
+  assert.equal(escapeHtml("Alice"), "Alice");
+  assert.equal(escapeHtml("O'Brien"), "O&#039;Brien");
+  assert.equal(escapeHtml('Say "hello"'), "Say &quot;hello&quot;");
+  assert.equal(escapeHtml("a < b"), "a &lt; b");
+  assert.equal(escapeHtml("a > b"), "a &gt; b");
+  assert.equal(escapeHtml("M&Ms"), "M&amp;Ms");
+
+  const xss = '<script>alert("xss")</script>';
+  assert.equal(escapeHtml(xss), "&lt;script&gt;alert(&quot;xss&quot;)&lt;/script&gt;");
+
+  const imgXss = '<img src=x onerror="alert(1)">';
+  assert.equal(escapeHtml(imgXss), "&lt;img src=x onerror=&quot;alert(1)&quot;&gt;");
+
+  const safe = escapeHtml(xss);
+  assert.ok(!safe.includes("<script>"));
+  assert.ok(!safe.includes("</script>"));
+  assert.ok(!safe.includes('"'));
+});
+
+test("escapeHtml handles edge cases", () => {
+  assert.equal(escapeHtml("   "), "   ");
+  assert.equal(escapeHtml("a".repeat(1000)), "a".repeat(1000));
+
+  assert.equal(escapeHtml("Jack &amp; Jill"), "Jack &amp;amp; Jill");
+
+  assert.equal(escapeHtml("\n\t"), "\n\t");
+});
+
+test("escapeHtml in attribute context prevents injection", () => {
+  const name = 'John "Drop Table" Doe';
+  const escaped = escapeHtml(name);
+  const attr = `data-name="${escaped}"`;
+  assert.equal(attr, 'data-name="John &quot;Drop Table&quot; Doe"');
+
+  const singleQuote = "O'Brien";
+  const escaped2 = escapeHtml(singleQuote);
+  const attr2 = `data-author="${escaped2}"`;
+  assert.equal(attr2, 'data-author="O&#039;Brien"');
+});
+
+test("regression: malicious speaker name in transcript entry pattern", () => {
+  const malicious = '<script>alert("xss")</script>';
+  const speaker = escapeHtml(malicious);
+
+  const initials = speaker
+    .split(" ")
+    .filter(Boolean)
+    .map((w) => w[0])
+    .join("")
+    .toUpperCase()
+    .slice(0, 2);
+
+  assert.equal(initials, "&");
+  assert.ok(!initials.includes("<"));
+  assert.ok(!initials.includes(">"));
+  assert.ok(!initials.includes('"'));
+
+  const html = `<div class="transcript-speaker">${speaker}</div>`;
+  assert.ok(!html.includes("<script>"));
+  assert.ok(html.includes("&lt;script&gt;"));
+});
+
+test("escapeHtml output is safe when embedded in innerHTML", () => {
+  const payloads = [
+    '<script>alert("xss")</script>',
+    '<img src=x onerror="alert(1)">',
+    '"><script>alert(1)</script>',
+    "javascript:alert(1)",
+    "<<script>script>alert(1)</script>",
+  ];
+
+  for (const payload of payloads) {
+    const escaped = escapeHtml(payload);
+    assert.ok(!escaped.includes("<script>"), `payload still contains <script>: ${payload}`);
+    assert.ok(!escaped.includes("</script>"), `payload still contains </script>: ${payload}`);
+    assert.ok(!escaped.includes('"'), `payload still contains double quote: ${payload}`);
+  }
+});
+
+test("formatDuration", () => {
+  assert.equal(formatDuration(0), "00:00:00");
+  assert.equal(formatDuration(90), "00:01:30");
+  assert.equal(formatDuration(3661), "01:01:01");
+  assert.equal(formatDuration(86399), "23:59:59");
+  assert.equal(formatDuration(360000), "100:00:00");
+});
+
+test("sanitizeTopicStatus", () => {
+  assert.equal(sanitizeTopicStatus("completed"), "completed");
+  assert.equal(sanitizeTopicStatus("unresolved"), "unresolved");
+  assert.equal(sanitizeTopicStatus("active"), "active");
+  assert.equal(sanitizeTopicStatus("pending"), "active");
+  assert.equal(sanitizeTopicStatus(""), "active");
+});
diff --git a/src/utils/sanitize.test.ts b/src/utils/sanitize.test.ts
index 3c3e15fa..532e3393 100644
--- a/src/utils/sanitize.test.ts
+++ b/src/utils/sanitize.test.ts
@@ -1,54 +1,23 @@
 import assert from "node:assert/strict";
 import test from "node:test";
-import { escapeHtml, sanitizeClassName, sanitizeDataAttr } from "./sanitize";
+import { escapeHtml } from "./domHelpers";
+import { sanitizeClassName, sanitizeDataAttr } from "./sanitize";
 
-// Mock document for testing escapeHtml in Node.js environment
-const mockDiv = {
-  _textContent: "",
-  set textContent(val: string) {
-    this._textContent = val;
-    this.innerHTML = val.replace(/[&<>"']/g, (char) => {
-      const map: Record<string, string> = {
-        "&": "&amp;",
-        "<": "&lt;",
-        ">": "&gt;",
-        '"': "&quot;",
-        "'": "&#39;",
-      };
-      return map[char] || char;
-    });
-  },
-  get textContent() {
-    return this._textContent;
-  },
-  innerHTML: "",
-};
-
-(globalThis as any).document = {
-  createElement(tag: string) {
-    if (tag === "div") {
-      return mockDiv;
-    }
-    throw new Error(`Unsupported tag in mock: ${tag}`);
-  },
-};
-
-test("escapeHtml behavior", () => {
-  // Null/undefined inputs
+test("escapeHtml prevents XSS in text content", () => {
   assert.equal(escapeHtml(null), "");
   assert.equal(escapeHtml(undefined), "");
 
-  // Standard string inputs
+  assert.equal(escapeHtml(""), "");
   assert.equal(escapeHtml("hello"), "hello");
+  assert.equal(escapeHtml("Alice & Bob"), "Alice &amp; Bob");
   assert.equal(
     escapeHtml("<script>alert('xss')</script>"),
-    "&lt;script&gt;alert(&#39;xss&#39;)&lt;/script&gt;",
+    "&lt;script&gt;alert(&#039;xss&#039;)&lt;/script&gt;",
   );
 
-  // Non-string inputs
-  assert.equal(escapeHtml(42), "42");
-  assert.equal(escapeHtml(true), "true");
-  assert.equal(escapeHtml({ a: 1 }), "{&quot;a&quot;:1}");
+  const output = escapeHtml('<img src=x onerror="alert(1)">');
+  assert.equal(output, "&lt;img src=x onerror=&quot;alert(1)&quot;&gt;");
+  assert.ok(!output.includes('"'));
 });
 
 test("sanitizeClassName behavior", () => {
diff --git a/src/utils/sanitize.ts b/src/utils/sanitize.ts
index 861280a4..ef18b7b9 100644
--- a/src/utils/sanitize.ts
+++ b/src/utils/sanitize.ts
@@ -9,45 +9,17 @@
  */
 
 /**
- * Escapes HTML special characters in an arbitrary value to prevent XSS attacks.
+ * Escapes HTML special characters in a string to prevent XSS attacks.
  *
- * Accepts any type and converts it to a safe HTML string:
- * - `null` / `undefined` → `""`
- * - `string` → escaped as-is
- * - `number`, `boolean`, `symbol`, `bigint` → converted via `String()`
- * - objects / arrays → serialized via `JSON.stringify()`
- *
- * Internally delegates to a temporary `<div>` element so that the browser's
- * own HTML serialiser handles all edge cases (including supplementary Unicode
- * code points).
+ * @deprecated Use `escapeHtml` from `./domHelpers` instead — it has the same
+ *   contract for string values, is used by all rendering code, and works in
+ *   plain Node.js without a DOM mock. This re-export exists only to avoid
+ *   breaking existing imports during the migration.
  *
  * @param value - The raw, potentially untrusted value to escape.
- * @returns An HTML-safe string where `&`, `<`, `>`, `"`, and `'` are replaced
- *   with their corresponding HTML entities.
- *
- * @example
- * element.innerHTML = escapeHtml(userInput);
- * // '<script>alert(1)</script>' → '&lt;script&gt;alert(1)&lt;/script&gt;'
+ * @returns An HTML-safe string.
  */
-export function escapeHtml(value: unknown): string {
-  if (value === null || value === undefined) return "";
-  let str: string;
-  if (typeof value === "string") {
-    str = value;
-  } else if (
-    typeof value === "number" ||
-    typeof value === "boolean" ||
-    typeof value === "symbol" ||
-    typeof value === "bigint"
-  ) {
-    str = String(value);
-  } else {
-    str = JSON.stringify(value);
-  }
-  const div = document.createElement("div");
-  div.textContent = str;
-  return div.innerHTML;
-}
+export { escapeHtml } from "./domHelpers";
 
 /**
  * Validates a class name string against an explicit allowlist to prevent

From bf64afcee83384d9493c394a282374481fd8ef6a Mon Sep 17 00:00:00 2001
From: Deepesh Kafaltiya <kafaltiyadeepesh@gmail.com>
Date: Mon, 22 Jun 2026 11:48:02 +0530
Subject: [PATCH 2/3] docs: add detailed troubleshooting and common errors
 section to README

---
 README.md | 46 ++++++++++++++++++++++++++++++++++------------
 1 file changed, 34 insertions(+), 12 deletions(-)

diff --git a/README.md b/README.md
index 8e8c7c7f..951e895f 100644
--- a/README.md
+++ b/README.md
@@ -979,20 +979,42 @@ _Made with 🖤 by the Late Meet community · [Report Bug](https://github.com/sh
 
 ---
 
-## Troubleshooting
-
-| Issue                                    | Cause                                     | Fix                                                          |
-| ---------------------------------------- | ----------------------------------------- | ------------------------------------------------------------ |
-| Transcription not starting               | Microphone permission denied              | Click the lock icon in Chrome address bar → Allow Microphone |
-| Extension popup shows "Not in a meeting" | Tab is not a Google Meet tab              | Navigate to meet.google.com first                            |
-| API key error                            | Key not set or expired                    | Open extension Options and re-enter your API key             |
-| Transcript stops mid-meeting             | Chrome service worker restarted           | Refresh the Meet tab and restart recording                   |
-| Speaker names show as "Unknown"          | Non-ASCII names or Google Meet DOM change | Update the extension to the latest version                   |
-| Storage quota exceeded                   | Too many saved meetings                   | Open the dashboard and delete old sessions                   |
+## 🔍 Troubleshooting & Common Errors
+
+If you encounter issues while setting up or running **Late-Meet**, check the common scenarios below before opening a new issue.
+
+### 1. Tab Capture & Audio Failures
+* **Symptom:** The extension states it is active, but audio isn't being captured or transcribed.
+* **Fix:** 
+  * Click the lock icon in the Chrome address bar and ensure **Microphone** permission is set to **Allow**.
+  * Ensure you have granted the active tab permission when prompted by Chrome.
+  * Check if you have other aggressive audio-routing or volume-boosting extensions active, as they can conflict with Chrome's `tabCapture` API. Try disabling them temporarily.
+
+### 2. Invalid API Key Errors (`401 Unauthorized`)
+* **Symptom:** Summaries or transcriptions fail to generate, or extension shows API key errors.
+* **Fix:**
+  * Open the extension **Options** and re-enter your **OpenAI** and **ElevenLabs** API keys. Ensure there are no accidental spaces at the beginning or end of the text strings.
+  * Log into your OpenAI / ElevenLabs dashboards to verify that your account has a remaining usage quota/credits.
+
+### 3. Extension Shows "Not in a meeting"
+* **Symptom:** The popup dashboard does not recognize the session.
+* **Fix:** Late-Meet tracks native active sessions. Navigate to `meet.google.com` and click **Start Copilot** *after* joining the Meet call—not before.
+
+### 4. Changes Don't Reflect (For Contributors)
+* **Symptom:** You updated the source code files, but the extension behaves exactly the same way in the browser.
+* **Fix:**
+  * Go to `chrome://extensions/` in your browser.
+  * Find the **Late-Meet** card.
+  * Click the **Reload (🔄)** icon in the bottom right corner of the card to clear the old build cache and apply your latest updates.
+
+### 5. How to Inspect Extension Error Logs
+If an error persists or you run into a transcript drop mid-meeting, check the hidden developer logs to find the exact error code:
+* **Popup Errors:** Right-click anywhere inside the extension popup window and select **Inspect**. Look at the *Console* tab.
+* **Background Script Errors:** Go to `chrome://extensions/`, enable **Developer mode** (top right toggle), find **Late-Meet**, and click on the `background.ts` / `background.js` link next to "Inspect views".
 
 ---
 
-## Global Shortcuts
+## ⌨️ Global Shortcuts
 
 | Shortcut      | Action                       |
 | ------------- | ---------------------------- |
@@ -1001,4 +1023,4 @@ _Made with 🖤 by the Late Meet community · [Report Bug](https://github.com/sh
 | `Alt+Shift+S` | Generate meeting summary     |
 | `Alt+Shift+E` | Export transcript            |
 
-> **Note:** Shortcuts can be customized at `chrome://extensions/shortcuts`
+> **Note:** Control Late Meet without touching your mouse! Shortcuts can be customized anytime at `chrome://extensions/shortcuts`.

From 6cd8014d08821c009b1052f3e3035519ad9da3c9 Mon Sep 17 00:00:00 2001
From: Deepesh Kafaltiya <kafaltiyadeepesh@gmail.com>
Date: Sat, 27 Jun 2026 16:32:21 +0530
Subject: [PATCH 3/3] style: fix README.md formatting with Prettier

---
 README.md | 42 ++++++++++++++++++++++++------------------
 1 file changed, 24 insertions(+), 18 deletions(-)

diff --git a/README.md b/README.md
index 951e895f..899bfc0a 100644
--- a/README.md
+++ b/README.md
@@ -984,33 +984,39 @@ _Made with 🖤 by the Late Meet community · [Report Bug](https://github.com/sh
 If you encounter issues while setting up or running **Late-Meet**, check the common scenarios below before opening a new issue.
 
 ### 1. Tab Capture & Audio Failures
-* **Symptom:** The extension states it is active, but audio isn't being captured or transcribed.
-* **Fix:** 
-  * Click the lock icon in the Chrome address bar and ensure **Microphone** permission is set to **Allow**.
-  * Ensure you have granted the active tab permission when prompted by Chrome.
-  * Check if you have other aggressive audio-routing or volume-boosting extensions active, as they can conflict with Chrome's `tabCapture` API. Try disabling them temporarily.
+
+- **Symptom:** The extension states it is active, but audio isn't being captured or transcribed.
+- **Fix:**
+  - Click the lock icon in the Chrome address bar and ensure **Microphone** permission is set to **Allow**.
+  - Ensure you have granted the active tab permission when prompted by Chrome.
+  - Check if you have other aggressive audio-routing or volume-boosting extensions active, as they can conflict with Chrome's `tabCapture` API. Try disabling them temporarily.
 
 ### 2. Invalid API Key Errors (`401 Unauthorized`)
-* **Symptom:** Summaries or transcriptions fail to generate, or extension shows API key errors.
-* **Fix:**
-  * Open the extension **Options** and re-enter your **OpenAI** and **ElevenLabs** API keys. Ensure there are no accidental spaces at the beginning or end of the text strings.
-  * Log into your OpenAI / ElevenLabs dashboards to verify that your account has a remaining usage quota/credits.
+
+- **Symptom:** Summaries or transcriptions fail to generate, or extension shows API key errors.
+- **Fix:**
+  - Open the extension **Options** and re-enter your **OpenAI** and **ElevenLabs** API keys. Ensure there are no accidental spaces at the beginning or end of the text strings.
+  - Log into your OpenAI / ElevenLabs dashboards to verify that your account has a remaining usage quota/credits.
 
 ### 3. Extension Shows "Not in a meeting"
-* **Symptom:** The popup dashboard does not recognize the session.
-* **Fix:** Late-Meet tracks native active sessions. Navigate to `meet.google.com` and click **Start Copilot** *after* joining the Meet call—not before.
+
+- **Symptom:** The popup dashboard does not recognize the session.
+- **Fix:** Late-Meet tracks native active sessions. Navigate to `meet.google.com` and click **Start Copilot** _after_ joining the Meet call—not before.
 
 ### 4. Changes Don't Reflect (For Contributors)
-* **Symptom:** You updated the source code files, but the extension behaves exactly the same way in the browser.
-* **Fix:**
-  * Go to `chrome://extensions/` in your browser.
-  * Find the **Late-Meet** card.
-  * Click the **Reload (🔄)** icon in the bottom right corner of the card to clear the old build cache and apply your latest updates.
+
+- **Symptom:** You updated the source code files, but the extension behaves exactly the same way in the browser.
+- **Fix:**
+  - Go to `chrome://extensions/` in your browser.
+  - Find the **Late-Meet** card.
+  - Click the **Reload (🔄)** icon in the bottom right corner of the card to clear the old build cache and apply your latest updates.
 
 ### 5. How to Inspect Extension Error Logs
+
 If an error persists or you run into a transcript drop mid-meeting, check the hidden developer logs to find the exact error code:
-* **Popup Errors:** Right-click anywhere inside the extension popup window and select **Inspect**. Look at the *Console* tab.
-* **Background Script Errors:** Go to `chrome://extensions/`, enable **Developer mode** (top right toggle), find **Late-Meet**, and click on the `background.ts` / `background.js` link next to "Inspect views".
+
+- **Popup Errors:** Right-click anywhere inside the extension popup window and select **Inspect**. Look at the _Console_ tab.
+- **Background Script Errors:** Go to `chrome://extensions/`, enable **Developer mode** (top right toggle), find **Late-Meet**, and click on the `background.ts` / `background.js` link next to "Inspect views".
 
 ---