From a50bd39df2fbc1fa994249ad24f1a02eb3f4ad8a Mon Sep 17 00:00:00 2001
From: Fringg <egor.andrianovv@gmail.com>
Date: Wed, 29 Apr 2026 09:06:29 +0300
Subject: [PATCH] fix: validate counterId/conversionId before script injection
 (XSS prevention)

---
 src/hooks/useAnalyticsCounters.ts | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/hooks/useAnalyticsCounters.ts b/src/hooks/useAnalyticsCounters.ts
index 8d02a2e..2b5ee7f 100644
--- a/src/hooks/useAnalyticsCounters.ts
+++ b/src/hooks/useAnalyticsCounters.ts
@@ -12,6 +12,7 @@ function removeElement(id: string) {
 }
 
 function injectYandexMetrika(counterId: string) {
+  if (!/^\d{1,15}$/.test(counterId)) return;
   try {
     localStorage.setItem('ym_counter_id', counterId);
   } catch {
@@ -38,6 +39,7 @@ function injectYandexMetrika(counterId: string) {
 }
 
 function injectGoogleAds(conversionId: string) {
+  if (!/^[A-Za-z0-9_-]{1,30}$/.test(conversionId)) return;
   if (document.getElementById(GTAG_LOADER_ID)) return;
 
   // External gtag.js loader