fix: DOM text reinterpreted as HTML leading to self-XSS #633
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Fix code scanning alert no. 9: DOM text reinterpreted as HTML
ojeytonwilliams
requested changes
Jan 3, 2025
There was a problem hiding this comment.
Hi @devanshbatham, thanks for addressing this issue. Could you take a look at the errors? Then we should be able to get this in.
|
Sorry, I meant: could you fix the lint error? It should be enough to run prettier. |
ojeytonwilliams
approved these changes
Jan 3, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Checklist:
Update index.md)Please also see an email I sent to
possible-security-issue at freecodecamp dot org.To fix this issue, we need to ensure that any user input is properly sanitized or escaped before being used in a context where it can be interpreted as HTML. In this case, we should use
textContentinstead ofinnerHTMLto avoid interpreting the text as HTML. Additionally, we should ensure that the URL is properly encoded.urlDiv.innerHTML = url;withurlDiv.textContent = url;to prevent the text from being interpreted as HTML.encodeURIComponentfor the query parameters.