You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
const gifPayload = { ...message, ...{ contentimg: values.url, meta: gifMeta } }; // overwrite any existing contentimg. leave the rest of the meta data tho
@@ -11407,7 +11417,7 @@ function loadPollPreset(pollId) {
<td>When the seller follower count changes from the seller stats endpoint.</td>
907
+
<td><code>meta</code> is an integer follower count. The source polls the seller endpoint every 5 minutes because the endpoint cache only refreshes on that cadence.</td>
<td>Metadata-only snapshot under <code>meta</code>, including available sections such as <code>meta.navigation</code>, <code>meta.playerCards</code>, <code>meta.liveEvents</code>, <code>meta.livePreview</code>, <code>meta.currentEvent</code>, and <code>meta.upcomingEvents</code>.</td>
<td>When eBay Live renders a heart/reaction animation.</td>
922
+
<td>Sent directly to the dedicated reactions target. <code>meta.reactionType</code> is <code>heart</code>; eBay does not expose a per-user name for these DOM animations.</td>
923
+
</tr>
914
924
</tbody>
915
925
</table>
916
926
<pclass="field-highlights">eBay metadata events intentionally omit <code>chatname</code>/<code>chatmessage</code>; downstream overlays should render from <code>data.event</code> + <code>data.meta</code> only.</p>
-`poll.html:739-741`: `compactChoiceText()` removes all non-alphanumeric characters, so option text like `goof!` and `goof` normalize to the same value and can both count the same vote path.
6
+
7
+
-`poll.html:845-846`: `parseInt(vote, 10)` accepts values with trailing characters (for example `1abc`), so non-numeric tokens can be interpreted as valid numeric votes in multiple/yes-no polls.
8
+
9
+
-`baretempate.html:76-77`, `bot.html:1853-1857`, `battle.html:444-445`, `confetti.html:230-231`, `content.html:443-444`, `credits.html:993-994`, `emotes.html:503-504`, `games.html:563-564`, `featured.html:2355-2357`, `gif.html:566-568`, `games/wordstorm.html:667-668`, `themes/featured-styles/featured-gaming.html:723-727`, `themes/featured-styles/featured-particles.html:669-670`, `themes/featured-styles/featured-neon.html:711-712`, `themes/overlay-bubbles.html:768-769`, `themes/overlay-cards.html:790-791`, `themes/compact-glass.html:626-627`, `dock.html:8215-8218`: multiple overlay/game/theme message handlers use `"overlayNinja" in e.data.dataReceived` or equivalent checks without null/shape guards, so unexpected `message` events can throw and stop processing overlay payloads.
10
+
11
+
-`content.html:519`, `emotes.html:574`: both use `parseInt(Math.random*100000000)` instead of invoking `Math.random()`, producing `NaN` IDs that can break dedupe/linking flows that expect integer identifiers.
12
+
13
+
## Medium
14
+
15
+
-`poll.html:720-727`: hashtag matching in `getVoteCandidates()` only accepts ASCII token characters (`[A-Za-z0-9_][A-Za-z0-9_-]*`), so valid unicode/extended hashtags are ignored in hashtag-anywhere mode.
16
+
17
+
-`aiprompt.html:1029-1030`, `aiprompt.html:1159`, `aiprompt.html:1321-1322`, `aiprompt.html:1395`: URL query params (`limit`, `showtime`, `duration`, `target`, `start`, `minutes`) are parsed with `parseInt(...)`/`Math.max(...)` and no `NaN` fallback, so malformed values (for example `?limit=bad`) become `NaN` and disable the feed cap (`while (feed.children.length > limit)` never truncates).
18
+
19
+
-`background.js:484-487` and `background.js:15757`, `background.js:15834`: `String.prototype.replaceAll()` is used for GIF parsing and stream ID generation; this is not available in Chrome-80-era environments despite this project's compatibility note.
20
+
21
+
-`gif.html:327-329`, `gif.html:339`: `detectMediaType()` does an unbounded `HEAD` request before any timeout and proceeds even when `fetch` stalls or returns unexpected content, so media queues can wait unnecessarily and degrade overlay responsiveness.
22
+
23
+
-`tts.js:617-632`, `tts.js:764-766`, `tts.js:798`, `tts.js:814-815`: numeric URL params are parsed with `parseFloat/parseInt(... ) || default`, which makes valid zero values impossible and can leave fields as `NaN` when malformed input is passed.
24
+
25
+
-`dock.html:3781-3804`, `dock.html:3789`, `dock.html:4858-4862`, `dock.html:4930`: room IDs are taken from URL params and only normalized in a narrow file:// branch (`prompt` path), so socket joins can use malformed/trimless values from normal URL-sourced sessions without the same validation.
0 commit comments