gitea-admin/gh-christianlouis-docuelevate
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

🛡️ Sentinel: [HIGH] Fix DOM-based XSS in upload.js (#900)

Browse Source 
* 🛡️ Sentinel: [HIGH] Fix DOM-based XSS in upload.js

Added `_escapeHtml` function to sanitize user-controlled `file.name` before interpolating it into the `row.innerHTML` payload, preventing malicious file names from executing XSS during uploads.

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>

* Tighten XSS fix PR payload

---------

Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
Co-authored-by: Christian Krakau-Louis <christian@Christians-Mac-mini-7.local>
This commit is contained in:
Christian Krakau-Louis
2026-05-30 07:36:58 +02:00
committed by GitHub
parent 6e4824cb74
commit 00ec6888c5
1 changed files with 12 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
frontend/static/js/upload.js
+12 -2
View File
@@ -293,13 +293,24 @@ function processFiles(files, progressContainer, statusMessage) {
updateStatus(); updateStatus();
} }
function _escapeHtml(str) {
if (!str) return '';
return String(str)
.replace(/&/g, '&amp;')
.replace(/</g, '&lt;')
.replace(/>/g, '&gt;')
.replace(/"/g, '&quot;')
.replace(/'/g, '&#039;');
}
// Pre-create one progress row per file. // Pre-create one progress row per file.
const queueItems = fileArray.map((file) => { const queueItems = fileArray.map((file) => {
const row = document.createElement('div'); const row = document.createElement('div');
row.className = 'flex flex-col mb-2'; row.className = 'flex flex-col mb-2';
const safeFileName = _escapeHtml(file.name);
row.innerHTML = ` row.innerHTML = `
<div class="flex justify-between"> <div class="flex justify-between">
<span class="text-sm truncate" title="${file.name}">${file.name}</span> <span class="text-sm truncate" title="${safeFileName}">${safeFileName}</span>
<span class="text-xs text-gray-500">${formatFileSize(file.size)}</span> <span class="text-xs text-gray-500">${formatFileSize(file.size)}</span>
</div> </div>
<div class="w-full bg-gray-200 h-2 rounded-full mt-1"> <div class="w-full bg-gray-200 h-2 rounded-full mt-1">
@@ -546,4 +557,3 @@ function initDragAndDrop(element, progressContainer, statusMessage, options = {}
}); });
} }