zoriya/v10
1
0
Fork 0
mirror of https://github.com/zoriya/v10.git synced 2026-08-16 02:45:09 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(packages): escape HTML special chars in serializeAttributes to prevent XSS (#1670)

Browse Source 
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: Wesley Luyten <me@wesleyluyten.com>
This commit is contained in:
Manuel Calleriza
2026-06-18 12:23:19 -07:00
committed by GitHub
co-authored by Claude Sonnet 4.6 Wesley Luyten
parent 9170a5879e
commit accf4bfa34
11 changed files with 322 additions and 38 deletions
Download Patch File Download Diff File Expand all files Collapse all files
site/scripts/build-ejected-skins.ts
+4 -4
View File
@@ -773,18 +773,18 @@ function evaluateTemplate(templateBody: string, context: Record<string, unknown>
.trim();
}
function escapeAttributeValue(value: string): string {
return value.replaceAll('&', '&amp;').replaceAll('"', '&quot;');
function escapeHtml(value: string): string {
return value.replaceAll('&', '&amp;').replaceAll('<', '&lt;').replaceAll('>', '&gt;').replaceAll('"', '&quot;');
}
function createRenderMediaIcon(iconSet: 'default' | 'minimal') {
return (name: string, attrs?: Record<string, string>): string => {
const family = iconSet === 'minimal' ? ' family="minimal"' : '';
const attrText = Object.entries(attrs ?? {})
.map(([key, value]) => ` ${key}="${escapeAttributeValue(value)}"`)
.map(([key, value]) => ` ${key}="${escapeHtml(value)}"`)
.join('');
return `<media-icon name="${escapeAttributeValue(name)}"${family}${attrText}></media-icon>`;
return `<media-icon name="${escapeHtml(name)}"${family}${attrText}></media-icon>`;
};
}