icecoder / ICEcoder

Browser code editor awesomeness
http://icecoder.net
Other
1.41k stars 348 forks source link

Fix usage of files/dirs with script based names #989

Open mattpass opened 2 years ago

mattpass commented 2 years ago

Describe the bug Create a file with name that's potentially XSS, eg <script>alert(1)<Xscript> - can open and save it fine, but in some places it's used (eg last 10 files, tab name, multiple results etc) it has problems displaying.

To Reproduce Steps to reproduce the behavior:

  1. Create a file called <script>alert(1)<Xscript> with any content and save
  2. Reload ICEcoder to see error
  3. It will also error in other places.

Expected behavior Handle it just as per any other file.

Additional context It may not be executable JS, but the first part is still parsed, so needs resolving.