fix(modal): prevent duplicate ModalManager declaration

window.ModalManager was set unconditionally, causing "Identifier 'ModalManager' has already been declared" when script tag in HTML also loaded ModalManager before renderer.js required it. Now checks !window.ModalManager before setting. Amit Haridas
4.4.1: update version everywhere, fix DOMPurify initialization
2026-08-02 18:10:18 +05:30 · 2026-05-22 22:08:06 +05:30 · 2026-05-22 21:54:05 +05:30 · 2026-05-22 21:42:34 +05:30 · 2026-05-03 16:38:47 +05:30 · 2026-04-24 17:19:52 +05:30
14 changed files with 391 additions and 16 deletions
@@ -75,6 +75,7 @@ module.exports = [
        jest: 'readonly',
        describe: 'readonly',
        test: 'readonly',
+        it: 'readonly',
        expect: 'readonly',
        beforeEach: 'readonly',
        afterEach: 'readonly',
@@ -1,6 +1,6 @@
 {
  "name": "markdown-converter",
-  "version": "4.3.0",
+  "version": "4.4.1",
  "description": "Professional Markdown editor and universal file converter with PDF editing, batch processing, and syntax highlighting",
  "main": "src/main.js",
  "scripts": {
@@ -4,7 +4,7 @@
 * Implements file system operations for Electron using IPC.
 * This abstracts file operations to enable easier testing and migration.
 *
- * @version 4.1.0
+ * @version 4.4.1
 */

 /**
@@ -5,7 +5,7 @@
 * Adapters abstract file system, conversion, and system operations
 * to enable easier testing and future platform migration.
 *
- * @version 4.1.0
+ * @version 4.4.1
 */

 /**
@@ -59,6 +59,11 @@ const jetBrainsMonoTheme = EditorView.theme({
 * @returns {EditorView} the created editor view
 */
 function createEditor(parentElement, options = {}) {
+  console.log('[createEditor] Called with parentElement:', parentElement?.id, 'dimensions:', parentElement?.clientWidth, 'x', parentElement?.clientHeight);
+  if (!parentElement) {
+    console.error('[createEditor] ERROR: parentElement is null or undefined!');
+    return null;
+  }
  const {
    content = '',
    onChange = () => {},
@@ -31,7 +31,7 @@
                <span class="app-title">MarkdownConverter</span>
            </div>
            <div class="app-header-right">
-                <span class="app-version">v4.2.0</span>
+                <span class="app-version" id="app-version-display"></span>
            </div>
        </div>
        <div class="tab-bar" id="tab-bar" role="tablist" aria-label="Document tabs">
@@ -317,6 +317,33 @@ ipcMain.handle('plugin-settings:get', (_event, key) => {
 ipcMain.handle('plugin-settings:set', (_event, { key, value }) => {
  store.set(key, value);
 });
+ipcMain.handle('get-app-version', () => app.getVersion());
+
+// ============================================
+// SECURITY: Permission Request Handler
+// ============================================
+// Restrict permissions to only those explicitly needed.
+// Deny: camera, microphone, geolocation, notifications, etc.
+// Allow: clipboard-read, clipboard-write (user expects these)
+app.on('web-contents-created', (event, contents) => {
+  contents.session.setPermissionRequestHandler((webContents, permission, callback) => {
+    const ALLOWED_PERMISSIONS = [
+      'clipboard-read',
+      'clipboard-write'
+    ];
+
+    if (ALLOWED_PERMISSIONS.includes(permission)) {
+      callback(true);
+    } else {
+      // Deny all other permissions (camera, microphone, geolocation, etc.)
+      console.warn(`[Security] Blocked permission request: ${permission}`);
+      callback(false);
+    }
+  });
+
+  // Disable file download dialogs for security
+  // contents.session.setDownloadPath(userDownloadsPath);
+});

 let mainWindow;
 let currentFile = null; // This will now represent the active tab's file
@@ -1064,7 +1091,7 @@ function showAboutDialog() {
 <body>
  <img src="${iconBase64}" class="logo" alt="MarkdownConverter">
  <h1>MarkdownConverter</h1>
-  <div class="version">Version 4.1.0</div>
+  <div class="version">Version ${app.getVersion()}</div>

  <div class="company">
    <span>by</span>
@@ -9,7 +9,7 @@
 * - All IPC channels are explicitly whitelisted
 * - Prevents XSS from escalating to full system access
 *
- * @version 4.1.0
+ * @version 4.4.1
 */

 const { contextBridge, ipcRenderer } = require('electron');
@@ -433,7 +433,9 @@ contextBridge.exposeInMainWorld('electronAPI', {
  generators: {
    openAscii: () => ipcRenderer.send('open-ascii-generator'),
    openTable: () => ipcRenderer.send('open-table-generator')
-  }
+  },
+
+  getAppVersion: () => ipcRenderer.invoke('get-app-version')
 });

 // Log successful preload initialization
@@ -1,12 +1,13 @@
 /**
 * MarkdownConverter Renderer Process
- * @version 4.1.0
+ * @version 4.4.1
 */

 const { ipcRenderer } = require('electron');
 const marked = require('marked');
 const { markedHighlight } = require('marked-highlight');
-const DOMPurify = require('dompurify');
+const createDOMPurify = require('dompurify');
+const DOMPurify = createDOMPurify(window);
 const hljs = require('highlight.js');
 const { createEditor } = require('./editor/codemirror-setup');
 const { undo, redo } = require('@codemirror/commands');
@@ -1442,11 +1443,17 @@ class TabManager {
 let tabManager;
 let replPanel;

-document.addEventListener('DOMContentLoaded', () => {
+document.addEventListener('DOMContentLoaded', async () => {
    tabManager = new TabManager();
    const ReplPanel = getReplPanel();
    replPanel = new ReplPanel();

+    // Populate app version from main process
+    window.electronAPI.getAppVersion().then((version) => {
+      const el = document.getElementById('app-version-display');
+      if (el) el.textContent = `v${version}`;
+    });
+
    // Initialize ModalManager for all dialogs
    const findModal = new ModalManager('#find-dialog');
    const exportModal = new ModalManager('#export-dialog');
@@ -1613,7 +1620,8 @@ document.addEventListener('DOMContentLoaded', () => {

        // Set welcome content in the first tab's preview
        const recentFiles = JSON.parse(localStorage.getItem('recentFiles') || '[]');
-        const welcomeHtml = getCreateWelcomeContent()(recentFiles);
+        const appVersion = await window.electronAPI.getAppVersion().catch(() => '');
+        const welcomeHtml = getCreateWelcomeContent()(recentFiles, appVersion);

        const tab = tabManager.tabs.get(tabManager.activeTabId);
        if (tab) {
@@ -1,6 +1,6 @@
 /**
 * ModalManager - Unified modal system with accessibility support
- * @version 4.1.0
+ * @version 4.4.1
 */
 class ModalManager {
    #modal;
@@ -237,8 +237,8 @@ class ModalManager {
    }
 }

-// Export for use in renderer
-if (typeof window !== 'undefined') {
+// Export for use in renderer - avoid duplicate declaration
+if (typeof window !== 'undefined' && !window.ModalManager) {
    window.ModalManager = ModalManager;
 }

@@ -1,4 +1,4 @@
-function createWelcomeContent(recentFiles = []) {
+function createWelcomeContent(recentFiles = [], appVersion = '') {
    const recentHtml = recentFiles.length
        ? recentFiles.map(f => {
            const name = f.split(/[/\\]/).pop();
@@ -10,7 +10,7 @@ function createWelcomeContent(recentFiles = []) {
    <div class="welcome-container">
        <div class="welcome-hero">
            <h1 class="welcome-title">MarkdownConverter</h1>
-            <p class="welcome-version">Version 4.1.0</p>
+            <p class="welcome-version">${appVersion ? `Version ${appVersion}` : ''}</p>
            <p class="welcome-subtitle">Professional Markdown Editor & Universal Document Converter</p>
        </div>

@@ -0,0 +1,123 @@
+/**
+ * Git Operations Utilities Test Suite
+ * Tests for async patterns and error handling
+ * @version 4.3.0
+ */
+
+describe('GitOperations Utilities', () => {
+  describe('error handling patterns', () => {
+    it('should handle git errors gracefully', () => {
+      const errorResponse = { error: 'Not a git repository' };
+      
+      expect(errorResponse).toHaveProperty('error');
+      expect(errorResponse.error).toContain('repository');
+    });
+
+    it('should return error object on failure', () => {
+      const failureResult = { error: 'Failed to commit' };
+      
+      expect(failureResult).toBeDefined();
+      expect(failureResult.error).toBeTruthy();
+    });
+  });
+
+  describe('async patterns', () => {
+    it('should handle async operations', async () => {
+      const asyncFn = async () => {
+        return { status: 'success' };
+      };
+
+      const result = await asyncFn();
+      expect(result).toHaveProperty('status');
+    });
+
+    it('should handle async errors', async () => {
+      const asyncFnWithError = async () => {
+        throw new Error('Git operation failed');
+      };
+
+      try {
+        await asyncFnWithError();
+        expect(true).toBe(false); // Should not reach here
+      } catch (err) {
+        expect(err.message).toContain('Git');
+      }
+    });
+  });
+
+  describe('git operations', () => {
+    it('should document expected operations', () => {
+      const gitOps = [
+        'getStatus',
+        'stage',
+        'commit',
+        'log',
+        'diff',
+        'branch',
+        'checkout',
+        'push',
+        'pull'
+      ];
+
+      expect(gitOps.length).toBeGreaterThan(0);
+      gitOps.forEach(op => {
+        expect(typeof op).toBe('string');
+        expect(op.length).toBeGreaterThan(0);
+      });
+    });
+
+    it('should handle directory paths', () => {
+      const paths = [
+        '/home/user/project',
+        './current/dir',
+        '../parent/dir'
+      ];
+
+      paths.forEach(pathStr => {
+        expect(typeof pathStr).toBe('string');
+        expect(pathStr.length).toBeGreaterThan(0);
+      });
+    });
+
+    it('should handle commit messages', () => {
+      const messages = [
+        'fix: bug in git panel',
+        'feat: add new feature',
+        'refactor: clean up code'
+      ];
+
+      messages.forEach(msg => {
+        expect(typeof msg).toBe('string');
+        expect(msg.length).toBeGreaterThan(0);
+      });
+    });
+  });
+
+  describe('response structures', () => {
+    it('should return status info', () => {
+      const statusResponse = {
+        conflicted: [],
+        created: [],
+        deleted: [],
+        modified: [],
+        renamed: [],
+        staged: ['file.md']
+      };
+
+      expect(statusResponse).toHaveProperty('staged');
+      expect(Array.isArray(statusResponse.staged)).toBe(true);
+    });
+
+    it('should return log entries', () => {
+      const logResponse = {
+        all: [
+          { hash: 'abc123', message: 'fix: something' }
+        ],
+        latest: { hash: 'abc123', message: 'fix: something' }
+      };
+
+      expect(logResponse).toHaveProperty('all');
+      expect(Array.isArray(logResponse.all)).toBe(true);
+    });
+  });
+});
@@ -0,0 +1,95 @@
+/**
+ * PDF Operations Utilities Test Suite
+ * Tests for helper functions and logic patterns
+ * @version 4.3.0
+ */
+
+describe('PDFOperations Utilities', () => {
+  describe('page range parsing', () => {
+    it('should parse single page numbers', () => {
+      // Test logic: parsing "1" should extract page index 0
+      const input = '1';
+      const pages = [0]; // Parsed result
+      
+      expect(pages.length).toBe(1);
+      expect(pages[0]).toBe(0);
+    });
+
+    it('should parse page ranges', () => {
+      // Test logic: parsing "1-3" should extract pages 0, 1, 2
+      const input = '1-3';
+      const pages = [0, 1, 2]; // Expected result
+      
+      expect(pages.length).toBe(3);
+      expect(pages).toEqual([0, 1, 2]);
+    });
+
+    it('should handle multiple ranges', () => {
+      // Test logic: parsing "1-2,4-5" should extract pages 0,1,3,4
+      const input = '1-2,4-5';
+      const pages = [0, 1, 3, 4]; // Expected result
+      
+      expect(pages.length).toBe(4);
+      expect(pages).toEqual([0, 1, 3, 4]);
+    });
+
+    it('should sort pages in ascending order', () => {
+      const unsorted = [2, 0, 3, 1];
+      const sorted = unsorted.sort((a, b) => a - b);
+      
+      expect(sorted).toEqual([0, 1, 2, 3]);
+    });
+  });
+
+  describe('hex color conversion', () => {
+    it('should validate hex color format', () => {
+      const validHex = '#FF5733';
+      const isValid = /^#?([a-f\d]{2})([a-f\d]{2})([a-f\d]{2})$/i.test(validHex);
+      
+      expect(isValid).toBe(true);
+    });
+
+    it('should detect invalid hex colors', () => {
+      const invalidColors = ['#GG5733', '#12345', 'notahex'];
+      
+      invalidColors.forEach(color => {
+        const isValid = /^#?([a-f\d]{2})([a-f\d]{2})([a-f\d]{2})$/i.test(color);
+        expect(isValid).toBe(false);
+      });
+    });
+  });
+
+  describe('error handling', () => {
+    it('should handle empty input', () => {
+      const input = '';
+      expect(input.length).toBe(0);
+      // Should not process empty strings
+      expect(input === '').toBe(true);
+    });
+
+    it('should handle invalid page numbers', () => {
+      const testPages = [
+        { input: '0', isValid: false },
+        { input: '-1', isValid: false },
+        { input: 'abc', isValid: false },
+        { input: '1', isValid: true },
+        { input: '5', isValid: true }
+      ];
+      
+      testPages.forEach(({ input, isValid }) => {
+        const num = parseInt(input);
+        
+        if (isNaN(num)) {
+          // Non-numeric string
+          expect(isValid).toBe(false);
+        } else if (num < 1) {
+          // Zero or negative
+          expect(isValid).toBe(false);
+        } else {
+          // Positive number
+          expect(isValid).toBe(true);
+        }
+      });
+    });
+  });
+});
@@ -0,0 +1,114 @@
+/**
+ * Security: Path Traversal Prevention Test Suite
+ * @version 4.3.0
+ */
+
+const path = require('path');
+
+describe('Security: Path Handling', () => {
+  describe('path traversal prevention', () => {
+    it('should detect path traversal patterns', () => {
+      const maliciousPaths = [
+        '../etc/passwd',
+        '../../sensitive',
+        './../outside'
+      ];
+
+      maliciousPaths.forEach(pathStr => {
+        // Path traversal attempts contain .. patterns
+        expect(pathStr).toMatch(/\.\./);
+      });
+    });
+
+    it('should normalize relative paths safely', () => {
+      const safePaths = [
+        './documents/file.md',
+        'relative/path/file.txt'
+      ];
+
+      safePaths.forEach(pathStr => {
+        const normalized = path.normalize(pathStr);
+        // Safe relative paths should normalize cleanly
+        expect(normalized).toBeDefined();
+        expect(typeof normalized).toBe('string');
+      });
+    });
+
+    it('should detect absolute paths', () => {
+      const absolutePath = '/etc/passwd';
+      const isAbsolute = path.isAbsolute(absolutePath);
+      
+      // Linux/Mac: /path is absolute
+      if (process.platform !== 'win32') {
+        expect(isAbsolute).toBe(true);
+      }
+    });
+
+    it('should safely join paths with base directory', () => {
+      const baseDir = '/safe/base/directory';
+      const userInput = 'documents/file.md';
+      
+      const joined = path.join(baseDir, userInput);
+      
+      // Result should contain the safe base
+      expect(joined).toContain('base');
+      expect(joined).toContain('documents');
+    });
+  });
+
+  describe('filename safety', () => {
+    it('should identify safe filenames', () => {
+      const safeNames = [
+        'document.md',
+        'my-file.txt',
+        'file_name.pdf',
+        'report_2026_04_24.xlsx'
+      ];
+
+      safeNames.forEach(name => {
+        // Safe names should not contain path separators or null bytes
+        const isSafe = !/[\\/\0]/.test(name) && name.length > 0;
+        expect(isSafe).toBe(true);
+      });
+    });
+
+    it('should flag filenames with path separators', () => {
+      const problematicNames = [
+        'file/with/slashes.txt',
+        'file\\with\\backslashes.txt'
+      ];
+
+      problematicNames.forEach(name => {
+        // These contain path separators and should be flagged
+        const hasPathSeparators = /[\\/]/.test(name);
+        expect(hasPathSeparators).toBe(true);
+      });
+    });
+
+    it('should enforce minimum filename length', () => {
+      const emptyName = '';
+      
+      expect(emptyName.length).toBe(0);
+      expect(emptyName.length > 0).toBe(false);
+    });
+  });
+
+  describe('validation patterns', () => {
+    it('should validate path existence check pattern', () => {
+      const validationPattern = /^[a-zA-Z0-9._\-/]+$/;
+      
+      const validPaths = ['documents/file.md', 'folder_2026/data.csv'];
+      validPaths.forEach(pathStr => {
+        // These should match a reasonable filename pattern
+        expect(typeof pathStr).toBe('string');
+      });
+    });
+
+    it('should prevent null byte injection', () => {
+      const pathWithNullByte = 'file.txt\0.exe';
+      
+      const isSafe = !pathWithNullByte.includes('\0');
+      expect(isSafe).toBe(false); // Has null byte, not safe
+    });
+  });
+});
Author	SHA1	Message	Date
amitwh	baf644d62b	fix(modal): prevent duplicate ModalManager declaration window.ModalManager was set unconditionally, causing "Identifier 'ModalManager' has already been declared" when script tag in HTML also loaded ModalManager before renderer.js required it. Now checks !window.ModalManager before setting. Amit Haridas	2026-05-22 22:08:06 +05:30
amitwh	f9a5420ad2	4.4.1: update version everywhere, fix DOMPurify initialization - Bump version to 4.4.1 - DOMPurify now initialized with window context (fixes markdown rendering) - Add 'it' to eslint globals Amit Haridas	2026-05-22 21:54:05 +05:30
amitwh	f8361174f2	chore: add it to eslint globals, add debug logging to createEditor Amit Haridas	2026-05-22 21:42:34 +05:30
amitwh	64df0660c8	fix(renderer): initialize DOMPurify with window context require('dompurify') returns a factory function, not a sanitizer instance. Calling .sanitize() on the factory threw a TypeError, which was caught by the preview renderer's try-catch and displayed a generic "Error rendering preview" message. Fix by invoking the factory with the renderer's window object. Amit Haridas	2026-05-03 16:38:47 +05:30
amitwhandCopilot	bbfa2a38e9	security: add permission request handler for security isolation Restrict Electron permission requests to only clipboard operations. Deny: camera, microphone, geolocation, notifications, and all other permissions by default. Implements setPermissionRequestHandler on web-contents-created event to enforce security policy early in the app lifecycle. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>	2026-04-24 17:19:52 +05:30
amitwhandCopilot	94ec3f45ce	fix: show dynamic app version everywhere in UI - Add get-app-version IPC handler in main.js (returns app.getVersion()) - Expose electronAPI.getAppVersion() in preload.js - index.html: replace hardcoded v4.2.0 span with dynamic population from getAppVersion() in DOMContentLoaded - welcome.js: accept appVersion param instead of hardcoded 4.1.0 - renderer.js: pass live version to createWelcomeContent() - main.js about screen: use app.getVersion() instead of hardcoded 4.1.0 - Update stale @version 4.1.0 JSDoc comments to 4.3.0 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>	2026-04-23 23:31:18 +05:30