zoriya/v10
1
0
Fork 0
mirror of https://github.com/zoriya/v10.git synced 2026-08-16 02:45:09 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(packages): escape HTML special chars in serializeAttributes to prevent XSS (#1670)

Browse Source 
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: Wesley Luyten <me@wesleyluyten.com>
This commit is contained in:
Manuel Calleriza
2026-06-18 12:23:19 -07:00
committed by GitHub
co-authored by Claude Sonnet 4.6 Wesley Luyten
parent 9170a5879e
commit accf4bfa34
11 changed files with 322 additions and 38 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/html/src/define/background/skin.ts
+3 -3
View File
@@ -1,11 +1,11 @@
import { ReactiveElement } from '@videojs/element';
import { ensureGlobalStyle, namedNodeMapToObject } from '@videojs/utils/dom';
import { ensureGlobalStyle } from '@videojs/utils/dom';
import { safeDefine } from '../safe-define';
import styles from './skin.css?inline';
const STYLES_ID = '__media-background-styles';
function getTemplateHTML(_attrs: Record<string, string>) {
function getTemplateHTML() {
return /*html*/ `
<media-container>
<!-- @deprecated slot="media" is no longer required, use the default slot instead -->
@@ -27,7 +27,7 @@ export class BackgroundVideoSkinElement extends ReactiveElement {
if (!this.shadowRoot) {
this.attachShadow((this.constructor as typeof BackgroundVideoSkinElement).shadowRootOptions);
this.shadowRoot!.innerHTML = getTemplateHTML(namedNodeMapToObject(this.attributes));
this.shadowRoot!.innerHTML = getTemplateHTML();
}
}
}