search

google / model-viewer

Easily display interactive 3D models on the web and in AR!
https://modelviewer.dev
Apache License 2.0
6.68k stars 799 forks source link

Update sidebar.ts DOM text reinterpreted as HTML #4756

Open Shivam7-1 opened 2 months ago

Shivam7-1 commented 2 months ago

By using innerText, it will avoid the risk of HTML injection, as these properties automatically escape any HTML special characters in the provided text. This helps prevent cross-site scripting (XSS) vulnerabilities by treating the input as plain text rather than interpreted HTML. Always be cautious when dealing with user input or dynamic content to prevent security risks.

And Also Added HTMLElement to Recognise innertext Element in it

Shivam7-1 commented 2 months ago

Hi @elalish Could You Please Review This PR Regards

elalish commented 2 months ago

I'll review it once you get the tests to pass. I'll be happy to answer questions if you have any.

Shivam7-1 commented 2 months ago

Hi @elalish Thanks For Reply I think it won't cause any test Failure Could you Check is there anything else Required Regards

elalish commented 2 months ago

I think it won't cause any test Failure

It is literally causing a build failure - it can't even get as far as running the tests. Do you see the Red X below? Please click on the details, understand the problem, then fix it.

Shivam7-1 commented 2 months ago

Hi @elalish Thanks For Reviewing I also Tried to Overcome From Unit Test Failure But It's always Faliling I had also try using textcontent instead of innertext But then also it's failing test case over here

Could You please Check over here is there any problem with config.json file ?

Regards