From 1501611f4f03e223de5465cce2440a5115c486e4 Mon Sep 17 00:00:00 2001 From: tomaioo Date: Mon, 27 Jul 2026 06:29:13 -0700 Subject: [PATCH] fix(security): reflected xss via innerhtml using url parameters The `applyTranslations` function reads URL parameters `mainHeading` and `mainSpan` and directly inserts them into the DOM using the `innerHTML` property. This occurs after decoding the URI component. An attacker can craft a malicious URL containing JavaScript payloads within these parameters. When a victim visits the crafted URL, the script will execute in the context of the victim's browser, leading to reflected Cross-Site Scripting (XSS). Signed-off-by: tomaioo <203048277+tomaioo@users.noreply.github.com> --- src-node/www/phoenix-splash/error.html | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src-node/www/phoenix-splash/error.html b/src-node/www/phoenix-splash/error.html index ec67c17a6a..2b712ed0a3 100644 --- a/src-node/www/phoenix-splash/error.html +++ b/src-node/www/phoenix-splash/error.html @@ -8,10 +8,10 @@ const urlSearchParams = new URLSearchParams(window.location.search); const params = Object.fromEntries(urlSearchParams.entries()); if(params.mainHeading){ - document.getElementById("mainHeading").innerHTML = decodeURIComponent(params.mainHeading); + document.getElementById("mainHeading").textContent = decodeURIComponent(params.mainHeading); } if(params.mainSpan){ - document.getElementById("mainSpan").innerHTML = decodeURIComponent(params.mainSpan); + document.getElementById("mainSpan").textContent = decodeURIComponent(params.mainSpan); } }