10.0.0-beta1 #971
10.0.0-beta1 #971
Conversation
Many fixes plus router
…aused fatal errors.
…king through the new server creation error.
…od_proclaim # Conflicts: # admin/src/Helper/Cwmparams.php
New mod_proclaimicon for Admin View.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| $.find(targetImage).show() | ||
| } | ||
|
|
||
| $.find(targetImage).attr('src', activeDir.join('/') + '/' + $(this).val()) |
Check warning
Code scanning / CodeQL
DOM text reinterpreted as HTML Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI 2 days ago
To fix the problem, we need to ensure that the value retrieved from $(this).val() is properly sanitized or escaped before being used to set the src attribute of the image element. This can be achieved by using a function that escapes any potentially dangerous characters in the value.
The best way to fix this without changing existing functionality is to use a utility function to escape the value before concatenating it with the rest of the URL. We can use a well-known library like lodash for this purpose, which provides a method _.escape to escape HTML characters.
| @@ -1 +1,2 @@ | ||
| import _ from 'lodash'; | ||
| /** | ||
| @@ -105,3 +106,3 @@ | ||
|
|
||
| $.find(targetImage).attr('src', activeDir.join('/') + '/' + $(this).val()) | ||
| $.find(targetImage).attr('src', activeDir.join('/') + '/' + _.escape($(this).val())) | ||
| }, |
| @@ -30,4 +30,3 @@ | ||
| "comments": false, | ||
| "ignore": [ | ||
| ] | ||
| "ignore": [] | ||
| }, | ||
| @@ -38,3 +37,4 @@ | ||
| "@hapi/hoek": "<=9.2.1", | ||
| "less": "^4.1.2" | ||
| "less": "^4.1.2", | ||
| "lodash": "^4.17.21" | ||
| } |
| Package | Version | Security advisories |
| lodash (npm) | 4.17.21 | None |
|
|
||
| if (sE && (url = sE.options[sE.selectedIndex].value)) | ||
| { | ||
| location.href = url |
Check warning
Code scanning / CodeQL
DOM text reinterpreted as HTML Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI 2 days ago
To fix the problem, we need to ensure that the url value is properly validated before it is used to set location.href. This can be done by checking that the url value is a valid and safe URL. We can use a regular expression to validate the URL format or use the URL constructor to ensure it is a valid URL.
The best way to fix the problem without changing existing functionality is to add a validation step before setting location.href. We will use the URL constructor to validate the URL.
| @@ -204,3 +204,8 @@ | ||
| { | ||
| location.href = url | ||
| try { | ||
| new URL(url); | ||
| location.href = url; | ||
| } catch (e) { | ||
| console.error('Invalid URL:', url); | ||
| } | ||
| } |
| const newmp4 = videolink.attr('data-src') | ||
| const player = $('#' + videoID) | ||
| player.get(0).pause() | ||
| player.attr('src', newmp4) |
Check warning
Code scanning / CodeQL
DOM text reinterpreted as HTML Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI 2 days ago
To fix the problem, we need to ensure that the value extracted from the data-src attribute is properly sanitized before being used. One way to achieve this is by using a library like DOMPurify to sanitize the URL. This will help prevent any malicious content from being executed.
- Import the DOMPurify library.
- Sanitize the
newmp4value before assigning it to thesrcattribute of the video element.
| @@ -1 +1,2 @@ | ||
| import DOMPurify from 'dompurify'; | ||
| (function (window, document, $) { | ||
| @@ -7,3 +8,3 @@ | ||
| const videolink = $('#' + contentPanelId) | ||
| const newmp4 = videolink.attr('data-src') | ||
| const newmp4 = DOMPurify.sanitize(videolink.attr('data-src')) | ||
| const player = $('#' + videoID) |
| @@ -30,4 +30,3 @@ | ||
| "comments": false, | ||
| "ignore": [ | ||
| ] | ||
| "ignore": [] | ||
| }, | ||
| @@ -38,3 +37,4 @@ | ||
| "@hapi/hoek": "<=9.2.1", | ||
| "less": "^4.1.2" | ||
| "less": "^4.1.2", | ||
| "dompurify": "^3.2.2" | ||
| } |
| Package | Version | Security advisories |
| dompurify (npm) | 3.2.2 | None |
# Conflicts: # site/helpers/media.php
First Beta release for public testing.