Version 2.1.3

Version 2.1.3

Security

• Resolved CodeQL warning js/xss-through-dom affecting profile image previews within the admin Profile Builder (view/adminhtml/web/js/profiles.js).
• Added strict validation for profile image URLs before assigning them to the preview <img> element.
• Profile image previews now only accept same-origin HTTP(S) URLs within /media/merlin_productfinder/.
• Applied the same validation to both existing profile images and newly uploaded images before rendering them in the admin UI.

Changed

• Switched profile image preview updates from jQuery .attr('src', ...) to .prop('src', ...) after URL validation.
• Improved upload error handling to provide clearer feedback when invalid image URLs are returned.
• Internal JavaScript hardening only.
• No functional or configuration changes for administrators.

---

Version 2.1.2

Security

• Resolved CodeQL warning js/incomplete-sanitization within the admin Profile Builder (view/adminhtml/web/js/profiles.js).
• Removed dynamic CSS selector generation for attribute set lookups.
• Attribute set names are now resolved using direct DOM value comparison instead of escaped selector strings, eliminating the need for manual sanitisation and improving code robustness.

Changed

• Internal JavaScript refactoring only.
• No changes to functionality, configuration, or the administrator user experience.

---