Joomla! Issue Tracker - CMS

Download
Launch
Feeling Lucky

[#44338] - Update debug.es6.js DOM Text Interpretd as html

NPM Resource Changed PR-5.2-dev Pending

User tests: Successful: Unsuccessful:

avatar Shivam7-1
Shivam7-1
22 Oct 2024

Summary of Changes

By using textContent, it will avoid the risk of HTML injection, as these properties automatically escape any HTML special characters in the provided text.
This helps make page more safer as compare to innerHTML and prevent cross-site scripting (XSS) vulnerabilities by treating the input as plain text rather than interpreted HTML.

Link to documentations

Please select:

  • Documentation link for docs.joomla.org:

  • No documentation changes for docs.joomla.org needed

  • Pull Request link for manual.joomla.org:

  • No documentation changes for manual.joomla.org needed

avatar Shivam7-1 Shivam7-1 - open - 22 Oct 2024
avatar Shivam7-1 Shivam7-1 - change - 22 Oct 2024
Status New ⇒ Pending
avatar joomla-cms-bot joomla-cms-bot - change - 22 Oct 2024
Category ⇒ JavaScript Repository NPM Change
avatar Shivam7-1 Shivam7-1 - change - 22 Oct 2024
The description was changed
avatar Shivam7-1 Shivam7-1 - edited - 22 Oct 2024
avatar Shivam7-1 Shivam7-1 - change - 22 Oct 2024
Title
…
Update debug.es6.js DOM Text Inter[retd as html
Update debug.es6.js DOM Text Interpretd as html
avatar Shivam7-1 Shivam7-1 - edited - 22 Oct 2024
avatar HLeithner HLeithner - change - 22 Oct 2024
Status Pending ⇒ Closed
Closed_Date 0000-00-00 00:00:00 ⇒ 2024-10-22 14:32:22
Closed_By ⇒ HLeithner
Labels Added: NPM Resource Changed PR-5.2-dev
avatar HLeithner HLeithner - close - 22 Oct 2024
avatar HLeithner
HLeithner - comment - 22 Oct 2024

This won't work as we inject HTML on purpose here.

avatar Shivam7-1
Shivam7-1 - comment - 22 Oct 2024

Hii @HLeithner
Thanks For Reviewing 😃
Can here use dompurify for sanitize the HTML Which won't Change innerhtml behaviour and also It will get more Secure Also ?

How is it ?
Regards

avatar dgrammatiko
dgrammatiko - comment - 22 Oct 2024

Can here use dompurify for sanitize the HTML

You could use

joomla-cms/build/media_source/system/js/core.es6.js

Lines 739 to 743 in a28c352

Joomla.sanitizeHtml = (unsafeHtml, allowList, sanitizeFn) => {
const allowed = (allowList === undefined || allowList === null)
? DefaultAllowlist : { ...DefaultAllowlist, ...allowList };
return sanitizeHtml(unsafeHtml, allowed, sanitizeFn);
};

avatar Shivam7-1
Shivam7-1 - comment - 25 Oct 2024

Hii @dgrammatiko @HLeithner Thanks For Suggestions
Accordingly I had Done Here #44342
Could You Please Review This PR
Thanks

Add a Comment

Login with GitHub to post a comment