search

google / model-viewer

Easily display interactive 3D models on the web and in AR!
https://modelviewer.dev
Apache License 2.0
6.88k stars 816 forks source link

Update create-html.ts DOM text reinterpreted as HTML #4757

Closed Shivam7-1 closed 1 month ago

Shivam7-1 commented 5 months ago

By using innerText, it will avoid the risk of HTML injection, as these properties automatically escape any HTML special characters in the provided text. This helps prevent cross-site scripting (XSS) vulnerabilities by treating the input as plain text rather than interpreted HTML. Always be cautious when dealing with user input or dynamic content to prevent security risks.

Shivam7-1 commented 5 months ago

Hi @elalish Could You Please Review This PR Regards

elalish commented 5 months ago

Have you tested the docs pages with this change to verify nothing has regressed?

Shivam7-1 commented 5 months ago

Hi @elalish Thanks For Replying I think it shouldn't cause any issue Regards

elalish commented 5 months ago

I think it shouldn't cause any issue

This kind of sentiment makes me very nervous. Please provide screenshots.

Shivam7-1 commented 5 months ago

Hi @elalish Thanks For Reviewing It Passes All Test As i check Here Unit test and fidelity test also Regards image image

elalish commented 5 months ago

Sorry, I may have been imprecise - the docs pages don't have automated tests - you have to manually look at them. What I mean is npm run serve and look at them to ensure they aren't broken. e.g.

image
NeilFraser commented 5 months ago

This PR would break this product since raw HTML would be printed on the user's screen.