wip #487
wip #487
Conversation
![github-advanced-security[bot]](https://app.smartcontext.ai/default/https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| function setAIButtonLoadingState(submitButton, isLoading) { | ||
| if (!isLoading) { | ||
| submitButton.disabled = false; | ||
| submitButton.innerHTML = submitButton.getAttribute('data-original-content') || 'Ingest'; |
Check warning
Code scanning / CodeQL
DOM text reinterpreted as HTML Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI about 18 hours ago
To fix the problem, we need to ensure that any value read from data-original-content and assigned to innerHTML is properly escaped so that it is interpreted as plain text, not HTML. The best way to do this is to use textContent instead of innerHTML when restoring the button's content, but only if the original content was plain text. However, if the original content may contain HTML (e.g., icons, formatting), we need to sanitize it before assigning it to innerHTML. For simplicity and safety, we can escape any meta-characters in the attribute value before assigning it to innerHTML. This can be done by creating a helper function that escapes HTML special characters (<, >, &, ", ') and using it when restoring the button's content.
Specifically, in setAIButtonLoadingState, on line 102, replace:
submitButton.innerHTML = submitButton.getAttribute('data-original-content') || 'Ingest';with:
submitButton.innerHTML = escapeHTML(submitButton.getAttribute('data-original-content')) || 'Ingest';and define the escapeHTML function in the same file.
| @@ -2,2 +2,17 @@ | ||
|
|
||
| // Escape HTML special characters to prevent XSS | ||
| function escapeHTML(str) { | ||
| if (!str) return ''; | ||
| return str.replace(/[&<>"']/g, function (m) { | ||
| switch (m) { | ||
| case '&': return '&'; | ||
| case '<': return '<'; | ||
| case '>': return '>'; | ||
| case '"': return '"'; | ||
| case "'": return '''; | ||
| default: return m; | ||
| } | ||
| }); | ||
| } | ||
|
|
||
| // Copy functionality | ||
| @@ -101,3 +116,3 @@ | ||
| submitButton.disabled = false; | ||
| submitButton.innerHTML = submitButton.getAttribute('data-original-content') || 'Ingest'; | ||
| submitButton.innerHTML = escapeHTML(submitButton.getAttribute('data-original-content')) || 'Ingest'; | ||
| submitButton.classList.remove('bg-[#ffb14d]', 'opacity-75', 'cursor-not-allowed'); |
No description provided.