From 16449e75a296d7c24f5fd3d4a01881a8f2a7928c Mon Sep 17 00:00:00 2001 From: Christian Krakau-Louis Date: Wed, 27 May 2026 07:11:06 +0200 Subject: [PATCH] Clarify DOM XSS example in sentinel note --- .jules/sentinel.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.jules/sentinel.md b/.jules/sentinel.md index 7d5fdb58..2261d69e 100644 --- a/.jules/sentinel.md +++ b/.jules/sentinel.md @@ -29,6 +29,6 @@ **Learning:** Initial URL validation is insufficient when the HTTP client is configured to follow redirects automatically. The client must be explicitly configured to validate every redirect target. **Prevention:** When using `httpx.AsyncClient(follow_redirects=True)` for user-provided URLs, always implement a redirect validator hook function (e.g., using `event_hooks={'response': [validate_redirect]}`) that resolves the `Location` header and passes it through the same SSRF validation logic before the redirect is followed. ## 2026-05-27 - DOM-based XSS in upload.js -**Vulnerability:** The `upload.js` frontend file directly injected the user-controlled `file.name` into a string literal passed to `row.innerHTML`. This allowed a malicious filename (e.g., ``) to execute arbitrary JavaScript in the victim's browser context (DOM-based XSS). +**Vulnerability:** The `upload.js` frontend file directly injected the user-controlled `file.name` into a string literal passed to `row.innerHTML`. This allowed a malicious filename (e.g., ``) to execute arbitrary JavaScript in the victim's browser context (DOM-based XSS). **Learning:** Even internal or local files uploaded by a user can contain malicious filenames. Any data dynamically interpolated into an HTML string that is subsequently rendered via `innerHTML` must be strictly sanitized. **Prevention:** Implement and apply an HTML escaping function (e.g., `_escapeHtml`) to replace dangerous characters (`&`, `<`, `>`, `"`, `'`) with their corresponding HTML entities before injecting user-controlled data into the DOM.