?
avatar brianteeman
brianteeman
28 May 2021

Unsanitized input from data from a remote resource flows into innerHTML, where it is used to dynamically construct the HTML page on client side. This may result in a DOM Based Cross-Site Scripting attack

progressMessage.innerHTML = json.message;

(reported in this repo as it is unreleased code following the advice of JSST)

avatar brianteeman brianteeman - open - 28 May 2021
avatar joomla-cms-bot joomla-cms-bot - change - 28 May 2021
Labels Added: ?
avatar joomla-cms-bot joomla-cms-bot - labeled - 28 May 2021
avatar brianteeman brianteeman - close - 9 Jun 2021
avatar brianteeman
brianteeman - comment - 9 Jun 2021

Closed see #34472

avatar brianteeman brianteeman - change - 9 Jun 2021
Status New Closed
Closed_Date 0000-00-00 00:00:00 2021-06-09 12:59:56
Closed_By brianteeman

Add a Comment

Login with GitHub to post a comment