Merge pull request #901 from christianlouis/sentinel-fix-xss-search-14130401506656403756

🛡️ Sentinel: [HIGH] Fix XSS vulnerability in search.html escapeHtml
2026-05-31 06:35:57 +02:00
parent cc561277c9 37c27c0213
commit 90844fe9ad
1 changed files with 7 additions and 3 deletions
@@ -298,9 +298,13 @@
  }

  function escapeHtml(str) {
-    const d = document.createElement('div');
-    d.textContent = str;
-    return d.innerHTML;
+    if (str === null || str === undefined) return '';
+    return String(str)
+      .replace(/&/g, '&amp;')
+      .replace(/</g, '&lt;')
+      .replace(/>/g, '&gt;')
+      .replace(/"/g, '&quot;')
+      .replace(/'/g, '&#039;');
  }

  /**