tridecco / game-client-web

Tridecco Game Client is a frontend application designed to support Tridecco games. It provides user interface rendering, user interaction handling, dynamic content loading, and communication with the backend server.
https://play.tridecco.com
GNU Affero General Public License v3.0
1 stars 0 forks source link

Fix XSS Vulnerability - DOM text reinterpreted as HTML (code scanning alert) #19

Closed TKanX closed 3 months ago

TKanX commented 3 months ago

Description:

A potential cross-site scripting (XSS) vulnerability in the handling of user input in rooms.ejs. The issue arises when user-provided values are directly used to construct URLs without proper escaping, which can lead to malicious scripts being executed.

Affected Files:

Proposed Solution:

Tracking issue for:

TKanX commented 3 months ago

Escapes user input to prevent XSS vulnerabilities

https://github.com/tridecco/game-client-web/commit/6d3c0ed8781dfa666ee9a4c0503974f4f8499605