etkr4k/bedolaga-cabinet
1
0
Fork 0
mirror of https://github.com/chillpadclub/bedolaga-cabinet.git synced 2026-07-28 09:33:46 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: validate counterId/conversionId before script injection (XSS prevention)

Browse Source
This commit is contained in:
Fringg
2026-04-29 09:06:29 +03:00
parent 80059681da
commit a50bd39df2
1 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
src/hooks/useAnalyticsCounters.ts
View File

@@ -12,6 +12,7 @@ function removeElement(id: string) {
} }
function injectYandexMetrika(counterId: string) { function injectYandexMetrika(counterId: string) {
if (!/^\d{1,15}$/.test(counterId)) return;
try { try {
localStorage.setItem('ym_counter_id', counterId); localStorage.setItem('ym_counter_id', counterId);
} catch { } catch {
@@ -38,6 +39,7 @@ function injectYandexMetrika(counterId: string) {
} }
function injectGoogleAds(conversionId: string) { function injectGoogleAds(conversionId: string) {
if (!/^[A-Za-z0-9_-]{1,30}$/.test(conversionId)) return;
if (document.getElementById(GTAG_LOADER_ID)) return; if (document.getElementById(GTAG_LOADER_ID)) return;
// External gtag.js loader // External gtag.js loader