From 519d5c696799b677e36fdf0e0f8fd1075e62df4c Mon Sep 17 00:00:00 2001
From: Peter Hedenskog <peter@soulgalore.com>
Date: Sun, 18 Oct 2026 23:07:54 +0200
Subject: [PATCH] Escape the URL in the navigation script

The URL under test was inserted into the navigation JavaScript as raw text inside double quotes. A URL containing a quote, a backslash or a line break broke navigation, and a crafted URL could run its own script in the page. The URL is now inserted as a JSON string literal.

Assisted-by: Claude Opus 5.5 noreply@anthropic.com
---
 lib/core/seleniumRunner.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/core/seleniumRunner.js b/lib/core/seleniumRunner.js
index dc23c36cf..0b6d00fe6 100644
--- a/lib/core/seleniumRunner.js
+++ b/lib/core/seleniumRunner.js
@@ -272,7 +272,7 @@ export class SeleniumRunner {
           }
           window.requestAnimationFrame(function(){
             window.requestAnimationFrame(function(){
-              window.location="${url}";
+              window.location=${JSON.stringify(url)};
             });
           });
         })();`;