remediate: replace eval cookie writes with safe JS helper + add tests (18.6 Track A)

Both SettingsCookieService and DarkModeCookieService now call window.DeepDrftSettings.setCookie (new Interop/settings/settings.ts) instead of eval. New tests cover SettingsServiceBase parse/format round-trip and the PreferenceAwareStreamingPlayerService invariant (Lossless skips probe; LowData inherits base).
2026-06-23 14:17:34 -04:00
parent c63c7ca033
commit 77c6c42c94
6 changed files with 318 additions and 6 deletions
@@ -27,8 +27,6 @@ public class SettingsCookieService(PublicSiteSettings settings, IJSRuntime js) :

    private async ValueTask WriteCookieAsync(string name, string value)
    {
-        var expires = DateTime.UtcNow.AddDays(ExpiryDays).ToString("R");
-        await js.InvokeVoidAsync("eval",
-            $"document.cookie = '{name}={value}; expires={expires}; path=/; SameSite=Lax'");
+        await js.InvokeVoidAsync("DeepDrftSettings.setCookie", name, value, ExpiryDays);
    }
 }