search

chromeos / chromeos.dev

chromeOS.dev is the digital home for all things ChromeOS. Learn how to adapt and optimize your existing apps to work on ChromeOS, the success other companies have had doing so, how to use ChromeOS as your developer machine, and keep up-to-date with the latest on ChromeOS.
https://chromeos.dev
Apache License 2.0
247 stars 79 forks source link

DOM text reinterpreted as HTML {Patch} #718

Closed Shivam7-1 closed 5 months ago

Shivam7-1 commented 5 months ago

Issue link: https://issuetracker.google.com/issues/330971377

By using innerText, it will avoid the risk of HTML injection, as these properties automatically escape any HTML special characters in the provided text. This helps prevent cross-site scripting (XSS) vulnerabilities by treating the input as plain text rather than interpreted HTML. Always be cautious when dealing with user input or dynamic content to prevent security risks.

Shivam7-1 commented 5 months ago

Hi @Snugug Could You please Review Above PR Thanks

Snugug commented 5 months ago

Hey @Shivam7-1, thanks for this PR!

I really appreciate the work you've done on it, but I'm going to close it without merging because our Great CMS Migration is almost ready to merge which supersedes this PR.

In general, though, I agree with the work you've done here. My only comment is that line 357 would wind up breaking some functionality we have, changing rendering a usable link into text, which isn't the outcome we'd want.

Thanks again for your work here and interest in helping improve the site!

Shivam7-1 commented 5 months ago

Hi @Snugug Thanks For Review PR I also Submitted About PR For Patch Reward Program Do I will be Eligible For that ? Thanks & Regards