filter xss in messages or node inputs #6

New Issue

2026-10-04T22:56:44+02:00

adam commented

2026-10-04 22:56:44 +02:00

The new addNewMessageChatEntry builds markup with ``div.innerHTML = [${ts}] ${from} ${short} ${text}``` while textcomes directly from/api/messages. Message contents are user-controlled and can include <script>oronerrorattributes, so assigning them toinnerHTMLallows a single malicious chat message to execute arbitrary JavaScript in every viewer’s browser. Render these fields withtextContent` or escape the message before inserting HTML to avoid XSS

The new addNewMessageChatEntry builds markup with ``div.innerHTML = [${ts}] ${from} ${short} ${text}``` while text` comes directly from `/api/messages`. Message contents are user-controlled and can include `<script>` or `onerror` attributes, so assigning them to `innerHTML` allows a single malicious chat message to execute arbitrary JavaScript in every viewer’s browser. Render these fields with `textContent` or escape the message before inserting HTML to avoid XSS

adam closed this issue

2026-10-04 22:56:44 +02:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: adam/potato-mesh#6