JS/XSS Injection via execCommand in PasteUtils

[akhil-reni]

Vulnerable code

export class PasteUtils {
  public static sanitizePastedTextContent(event: ClipboardEvent) {
    event.preventDefault();
    const text = event.clipboardData?.getData('text/plain');
    document.execCommand?.('insertHTML', false, text);
  }
}

Description

A potential security vulnerability exists in the PasteUtils class, specifically in the sanitizePastedTextContent method. The current implementation uses document.execCommand('insertHTML', false, text), which can allow JavaScript injection through pasted content.

Steps to Reproduce

1. Copy a string that includes JavaScript code.
2. Paste it into the relevant field where PasteUtils.sanitizePastedTextContent is used.
3. The JavaScript code gets executed.

Expected Behavior

Pasted text should be sanitized to prevent any potential JavaScript execution.

Actual Behavior

JavaScript can be executed through the execCommand('insertHTML', ...) method, leading to potential security risks.

Suggested Fix

Replace document.execCommand('insertHTML', false, text) with document.execCommand('insertText', false, text). This change will insert the text as plain text, mitigating the risk of JavaScript execution.

Additional Information

[OvidijusParsiunas]

You're an absolute star for raising this @akhil-reni. I have included this change in the following commit. This should hopefully be included in the main release tomorrow. Thanks!

[OvidijusParsiunas]

This has now been released in version 1.4.7. Thankyou!