TK-11538: gridControls appendChild off the prototype (consistency with catalogPage)

1d92019a0ab9283d24ea40ba43771a4ee4dad26e · 2026-09-14 10:40:06 -0700 · Steve Abrams

Closes the residual hardening sub-item. The titled bug (bare localStorage read
throwing in Safari private mode, killing sort+density) was already fixed in 8be45e2
and is verified LIVE on the fleet. This 1-line change makes gridControls' card
reorder use Node.prototype.appendChild.call(g,c) to match catalogPage's guarded
form append. Defense-in-depth only: a <div>'s appendChild is not DOM-clobberable
by its children the way a <form>'s named controls clobber the form. Rides the next
natural fleet deploy; no dedicated deploy warranted.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RcYGzMCFaJXH6nSLLrL4EQ

Files touched

M shared/render.js

Diff

commit 1d92019a0ab9283d24ea40ba43771a4ee4dad26e
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Mon Sep 14 10:40:06 2026 -0700

    TK-11538: gridControls appendChild off the prototype (consistency with catalogPage)
    
    Closes the residual hardening sub-item. The titled bug (bare localStorage read
    throwing in Safari private mode, killing sort+density) was already fixed in 8be45e2
    and is verified LIVE on the fleet. This 1-line change makes gridControls' card
    reorder use Node.prototype.appendChild.call(g,c) to match catalogPage's guarded
    form append. Defense-in-depth only: a <div>'s appendChild is not DOM-clobberable
    by its children the way a <form>'s named controls clobber the form. Rides the next
    natural fleet deploy; no dedicated deploy warranted.
    
    Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
    Claude-Session: https://claude.ai/code/session_01RcYGzMCFaJXH6nSLLrL4EQ
---
 shared/render.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/shared/render.js b/shared/render.js
index 20a028b..d9c0eab 100644
--- a/shared/render.js
+++ b/shared/render.js
@@ -723,7 +723,7 @@ function gridControls(cfg){
       if(k==='dark-light')return val(a,'color')[1]-val(b,'color')[1];
       var av=val(a,k),bv=val(b,k);return av<bv?-1:av>bv?1:0;
     });
-    arr.forEach(function(c){g.appendChild(c);});
+    arr.forEach(function(c){Node.prototype.appendChild.call(g,c);});// off the prototype for consistency with catalogPage (defense-in-depth; a <div>'s appendChild isn't clobberable by children the way a <form>'s named controls clobber the form)
   }
   var saved=read(sk);
   if(saved){var ok=Array.prototype.some.call(s.options,function(o){return o.value===saved;});if(ok){s.value=saved;sortBy(saved);}}

← 1decd1b auto-data-snapshot: 2026-09-14T09:19:35 (4 data files) — sit · back to Dw Domain Fleet · content drip: +4 fresh article(s) — etciemurals.com, fabricf e5dcb36 →