Christian Krakau-Louis
425805ab23
* 🛡️ Sentinel: [HIGH] Fix XSS in status_dashboard.html Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com> * fix: address status dashboard xss review nits --------- Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com> Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com> Co-authored-by: Christian Krakau-Louis <christian@Christians-Mac-mini-7.local>
873 B
2026-06-01 - [Fix XSS in status_dashboard.html]
Vulnerability: A Cross-Site Scripting (XSS) vulnerability existed in frontend/templates/status_dashboard.html where untrusted configuration settings (value), external service messages (data.message), and token expirations (data.token_info.expires_in_human) were injected directly into the DOM via .innerHTML without sanitization.
Learning: Even internal or admin-focused dashboards can be vulnerable if they display external or user-configurable data without escaping. Constructing HTML strings dynamically from unvalidated sources is a common vector for DOM-based XSS.
Prevention: Always use a sanitization function like escapeHtml to escape dangerous characters (<, >, &, ", ') before assigning dynamic content to .innerHTML, or prefer .textContent when only plaintext is intended.