HabitRPG / habitica-chat-extension

A habitica.com Chat Client for Chrome
18 stars 13 forks source link

Sanitize before inserting variables to innerHTML #83

Open SabreCat opened 2 years ago

SabreCat commented 2 years ago

We received this notice from Mozilla Add-ons:

image

To comply with the request, this PR adds calls to DOMPurify.sanitize() to strip any potentially problematic data from the variables being included in the innerHTML element on line 652 of chat_inPage.js.

cTheDragons commented 1 year ago

From my testing on Firefox 105.0.1 (64-bit) appears to be have been working.

The three issues are:

Tested:

All tested on default options but did open up on large text no avatar to confirm these options work too.

cTheDragons commented 1 year ago

From my testing on 105.0.5151.0 (Developer Build) (64-bit) appears to be have been working. Four Bugs:

Tested:

All tested on default options but did open up on large text no avatar to confirm these options work too.