etkr4k/bedolaga-cabinet
1
0
Fork 0
mirror of https://github.com/chillpadclub/bedolaga-cabinet.git synced 2026-07-30 10:27:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

docs(antilopay): document XSS invariant on setAttribute('content', ...)

Browse Source 
Security reviewer flagged that the safety of injecting payment-provider
verification tokens into <meta content=...> rests entirely on the use
of Element.setAttribute() (plain-string attribute, browser does not
parse as HTML). A future contributor switching to innerHTML or template-
string concatenation into <head> would turn this hook into an XSS sink.
Add a comment that calls this out explicitly so the invariant survives
maintenance.
This commit is contained in:
Fringg
2026-05-16 02:25:37 +03:00
parent 6fa4afd5c1
commit d85da9e03f
1 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
src/hooks/useSiteVerification.ts
View File

@@ -39,6 +39,12 @@ export function useSiteVerification(): void {
} }
function upsertMetaTag(name: string, content: string): void { function upsertMetaTag(name: string, content: string): void {
// Security note: `setAttribute('content', value)` stores `value` as a plain
// string attribute — the browser does NOT parse it as HTML. Even if a
// compromised backend returned `</meta><script>alert(1)</script>`, it would
// be stored literally inside `content="..."` and never executed. DO NOT
// switch to `innerHTML` / string concatenation into <head> — that would
// make this an XSS sink.
let tag = document.head.querySelector<HTMLMetaElement>(`meta[name="${name}"]`); let tag = document.head.querySelector<HTMLMetaElement>(`meta[name="${name}"]`);
if (!tag) { if (!tag) {
tag = document.createElement('meta'); tag = document.createElement('meta');