Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Added dompurify to sanityze the data parsed by the jquery #129

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

p4p1
Copy link

@p4p1 p4p1 commented Mar 16, 2024

I added calls to dompurify throughout the different sections of the code using the following template in the dompurify documentation:

const clean = DOMPurify.sanitize(dirty, { USE_PROFILES: { html: true } });

Since the jquery code is using .html to paste HTML code directly into the DOM the code was previously to Cross-Site-Scripting here is a quick fix it is not perfect but it's a good temporary fix for the time being.
To import the library I used the dom purify CDN on the following link

My github description is an XSS payload if I search for my profile on social analyzer through the web GUI the description is parsed then sanitized:

My description:

"/><img src="somelink" onerror="alert(document.domain)" />

the output of social-analyzer

image

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant