Files
77d7d4241a fix: safe rendering in agent-dashboard (fixes #59) (#87)
* feat: deprecate unsafe innerHTML examples and fix XSS vulnerabilities (fixes #59)

- Add deprecation warning to example 12-agent-dashboard with runtime DeprecationWarning
- Replace innerHTML usage in plugin.js with safe DOM APIs (textContent, createElement)
- Example 12 now warns users to migrate to examples/15-dashboard-test/ or examples/13-real-dashboard/
- Prevents XSS injection through API responses in admin dashboard

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <[email protected]>

* fix: replace innerHTML with safe DOM methods to prevent XSS (fixes #59)

- Fixed renderApiPageData function XSS in error handling
- Fixed renderComponents function XSS in JSON viewer
- Fixed renderCard function XSS in title, value, footer fields
- Fixed renderChart function XSS in title field
- Fixed renderTable function XSS in headers and cell data
- Fixed aiui.createBoard error handler XSS in error messages
- Fixed navigation items XSS in page titles and icons
- Fixed header branding XSS in site title and logo
- Fixed A2UI surface fallback XSS in JSON output
- Fixed component default case XSS in JSON output
- Fixed key-value list XSS in labels and values

All innerHTML usage with user-controlled API data has been replaced
with safe DOM methods (createElement, textContent, appendChild) to
prevent XSS vulnerabilities in the admin dashboard.

Co-authored-by: Mervin Praison <[email protected]>

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Claude <[email protected]>
Co-authored-by: Mervin Praison <[email protected]>
Co-authored-by: MervinPraison <[email protected]>
2026-06-15 16:25:58 +01:00
..

Example 28 — Full Extensibility Showcase

Demonstrates every extension point in PraisonAIUI.

Extension Points Demonstrated

# Extension Where Side
1 @aiui.page() app.py Server
2 aiui.form_action() app.py Server (returns dict)
3 @aiui.register_page_action() app.py Server (form handler)
4 window.aiui.registerView() plugin.js Client
5 window.aiui.registerComponent() plugin.js Client
6 Custom component type (timeline) app.py + plugin.js Both
7 Theme / branding / brand color app.py Server

Endpoints Exercised

Method Endpoint Purpose
GET /api/health Server health check
GET /api/pages List all registered pages
GET /api/pages/{id}/data Get a page's rendered components
POST /api/pages/{id}/action Submit a form-action from aiui.form_action()
GET /api/features List all registered feature protocols
GET /api/theme Get current theme variables
GET /api/overview Dashboard statistics

Run

python app.py
# Then visit: http://localhost:8082

Testing the custom component + custom view

The timeline component and the custom-view page are client-side extensions. app.py loads plugin.js automatically via aiui.set_custom_js() — no DevTools paste required.

  1. Open http://localhost:8082 in the browser
  2. Navigate to Custom Component → the timeline renders as a styled list
  3. Navigate to Client-Only View → a JS-rendered clock appears

Note: aiui.set_custom_js(path) injects client-side JS from a file path at page load. See docs/features/how-to-add-a-feature.md for the extension API contract.

Testing the form action

  1. Navigate to Contact Form
  2. Fill in the form (Name / Email / Age / Role / Newsletter / Notes)
  3. Click Save Contact
  4. The form POSTs to /api/pages/contact-form/action
  5. The server-side @aiui.register_page_action("contact-form") handler appends the contact to an in-memory list and returns {"status": "saved", ...}
  6. Reload the page — the contact appears in the table below the form

Curl the endpoints

# Health
curl http://localhost:8082/api/health

# All pages
curl http://localhost:8082/api/pages

# Overview page data
curl http://localhost:8082/api/pages/demo-overview/data

# Submit the contact form
curl -X POST http://localhost:8082/api/pages/contact-form/action \
     -H "Content-Type: application/json" \
     -d '{"Name":"Jane","Email":"[email protected]","Age":30,"Role":"PM"}'

# Features
curl http://localhost:8082/api/features

# Theme
curl http://localhost:8082/api/theme