Fix bugs and harden against XSS across the extension

[vict0rsch]

TL;DR

Fix a collection of bugs (scoping, logic, infinite loops) and harden the extension against XSS by escaping all user-controlled data injected into HTML via a new escapeHtml utility.

Breaking changes 🔥

None.

Changes

• XSS hardening: Add escapeHtml() utility and apply it across all innerHTML/template-literal injection points in popup templates, options page, content script, bib matcher, and shared utils. Covers paper titles, authors, tags, notes, code links, venue names, URLs, and error messages.
• Download sanitization: Replace ad-hoc character stripping with a proper filename sanitizer (reserved chars, control chars, path traversal, length limit) and validate pdfUrl is https?:// before downloading.
• Sender validation: Reject chrome.runtime.onMessage messages not originating from the extension itself.
• PAT redaction: Stop logging the GitHub Personal Access Token in plaintext; log [REDACTED] instead.
• Code injection → func API: Replace chrome.scripting.executeScript({ code: ... }) with the safer { func, args } form (MV3-compatible).
• Infinite loop fix: Bound the PDF title-setting loop (makeTitle) with a local iteration counter instead of the uncapped while(1).
• Bug fixes: Fix Array.prototype.last mutating the original array via .reverse(); fix mergePapers keeping the newer addDate instead of the oldest; fix prepareOverwriteData .map() destructuring; fix implicit globals (major, minor, pwcMatch, abstractH2); fix OpenReview regex capturing only the last character; remove dead code after early return in fetchPWCData; add missing done callback default in addOrUpdatePaper; replace undefined error() calls with logError() in parsers; add null guards on OpenReview URL regex matches.
• autoTag regex safety: Wrap user-provided regex in try/catch to prevent crashes on invalid patterns while preserving regex matching behavior.

Review hints

• escapeHtml in src/shared/js/utils/functions.js is the central utility — verify it covers the five OWASP-recommended characters (& < > " ').
• The cutAuthors(escapeHtml(paper.author)) call order in templates.js means entity-encoded strings are measured for truncation length — acceptable tradeoff but worth noting.
• The autoTagPaper change in parsers.js keeps new RegExp() with a try/catch instead of switching to .includes(), preserving regex UX as documented in the options UI.
• The sender.id check in background.js silently drops external messages — callers get undefined responses, which existing code handles.