From bb793a64d1ade6a3b27a9aa979f97953f87a2ebe Mon Sep 17 00:00:00 2001
From: Chris Duncan <chris@codecow.com>
Date: Mon, 3 Aug 2026 06:44:31 -0700
Subject: [PATCH] Remove naive XSS protection as there is no risk to IndexedDB
 and risk at RPC server is handled by nano-node.

---
 src/lib/rolodex.ts | 11 +++++------
 src/lib/rpc.ts     |  4 ----
 2 files changed, 5 insertions(+), 10 deletions(-)

diff --git a/src/lib/rolodex.ts b/src/lib/rolodex.ts
index 4437e38..3e690e8 100644
--- a/src/lib/rolodex.ts
+++ b/src/lib/rolodex.ts
@@ -43,11 +43,6 @@ export class Rolodex {
 		if (typeof address !== 'string') {
 			throw new Error('Address must be a string for rolodex entries')
 		}
-		name = name
-			.replaceAll('/', '\\u002f')
-			.replaceAll('<', '\\u003c')
-			.replaceAll('>', '\\u003e')
-			.replaceAll('\\', '\\u005c')
 		const account = new Account(address)
 
 		try {
@@ -145,6 +140,8 @@ export class Rolodex {
 	/**
 	 * Gets all names stored in the rolodex.
 	 *
+	 * Be sure to sanitize names before displaying in HTML to prevent XSS.
+	 *
 	 * @returns {Promise<string[]>} Promise for a list of all names stored in the rolodex
 	 */
 	static async getAllNames (): Promise<string[]> {
@@ -160,6 +157,8 @@ export class Rolodex {
 	/**
 	 * Gets the name associated with a specific Nano address from the rolodex.
 	 *
+	 * Be sure to sanitize names before displaying in HTML to prevent XSS.
+	 *
 	 * @param {string} address - Nano account address
 	 * @returns {Promise<string|null>} Promise for the name associated with the address, or null if not found
 	 */
@@ -180,7 +179,7 @@ export class Rolodex {
 	 *
 	 * @param {string} name - Alias to look up
 	 * @param {string} signature - Signature to use for verification
-	 * @param {string} data - Signed data to verify
+	 * @param {string} data - UTF-8 string of signed data to verify
 	 * @returns {Promise<boolean>} True if the signature was used to sign the data, else false
 	 */
 	static async verify (name: string, signature: string, data: string): Promise<boolean> {
diff --git a/src/lib/rpc.ts b/src/lib/rpc.ts
index 152efaa..f299002 100644
--- a/src/lib/rpc.ts
+++ b/src/lib/rpc.ts
@@ -41,10 +41,6 @@ export class Rpc {
 		data ??= {}
 		data.action = action.toLowerCase()
 		const body = JSON.stringify(data)
-			.replaceAll('/', '\\u002f')
-			.replaceAll('<', '\\u003c')
-			.replaceAll('>', '\\u003e')
-			.replaceAll('\\', '\\u005c')
 
 		const aborter = new AbortController()
 		const req = new Request(this.#u, {
-- 
2.52.0