From d85da9e03fbb82ac88af3abfd92755418debc1b9 Mon Sep 17 00:00:00 2001 From: Fringg Date: Sat, 16 May 2026 02:25:37 +0300 Subject: [PATCH] docs(antilopay): document XSS invariant on setAttribute('content', ...) Security reviewer flagged that the safety of injecting payment-provider verification tokens into rests entirely on the use of Element.setAttribute() (plain-string attribute, browser does not parse as HTML). A future contributor switching to innerHTML or template- string concatenation into would turn this hook into an XSS sink. Add a comment that calls this out explicitly so the invariant survives maintenance. --- src/hooks/useSiteVerification.ts | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/hooks/useSiteVerification.ts b/src/hooks/useSiteVerification.ts index b7b68db..935dade 100644 --- a/src/hooks/useSiteVerification.ts +++ b/src/hooks/useSiteVerification.ts @@ -39,6 +39,12 @@ export function useSiteVerification(): void { } function upsertMetaTag(name: string, content: string): void { + // Security note: `setAttribute('content', value)` stores `value` as a plain + // string attribute — the browser does NOT parse it as HTML. Even if a + // compromised backend returned ``, it would + // be stored literally inside `content="..."` and never executed. DO NOT + // switch to `innerHTML` / string concatenation into — that would + // make this an XSS sink. let tag = document.head.querySelector(`meta[name="${name}"]`); if (!tag) { tag = document.createElement('meta');