Christian Krakau-Louis
425805ab23
* 🛡️ Sentinel: [HIGH] Fix XSS in status_dashboard.html Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com> * fix: address status dashboard xss review nits --------- Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com> Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com> Co-authored-by: Christian Krakau-Louis <christian@Christians-Mac-mini-7.local>
5 lines
873 B
Markdown
5 lines
873 B
Markdown
## 2026-06-01 - [Fix XSS in status_dashboard.html]
|
|
**Vulnerability:** A Cross-Site Scripting (XSS) vulnerability existed in `frontend/templates/status_dashboard.html` where untrusted configuration settings (`value`), external service messages (`data.message`), and token expirations (`data.token_info.expires_in_human`) were injected directly into the DOM via `.innerHTML` without sanitization.
|
|
**Learning:** Even internal or admin-focused dashboards can be vulnerable if they display external or user-configurable data without escaping. Constructing HTML strings dynamically from unvalidated sources is a common vector for DOM-based XSS.
|
|
**Prevention:** Always use a sanitization function like `escapeHtml` to escape dangerous characters (`<`, `>`, `&`, `"`, `'`) before assigning dynamic content to `.innerHTML`, or prefer `.textContent` when only plaintext is intended.
|