search

google / model-viewer

Easily display interactive 3D models on the web and in AR!
https://modelviewer.dev
Apache License 2.0
6.68k stars 799 forks source link

snippet_viewer.ts DOM text reinterpreted as HTML #4747

Open Shivam7-1 opened 2 months ago

Shivam7-1 commented 2 months ago

By using innerText, it will avoid the risk of HTML injection, as these properties automatically escape any HTML special characters in the provided text. This helps prevent cross-site scripting (XSS) vulnerabilities by treating the input as plain text rather than interpreted HTML. Always be cautious when dealing with user input or dynamic content to prevent security risks.

Shivam7-1 commented 2 months ago

Hi @elalish Thanks For Reviewing I just check and Updated the test file also Thanks