Skip to content

Conversation

@p4p1
Copy link

@p4p1 p4p1 commented Mar 16, 2024

I added calls to dompurify throughout the different sections of the code using the following template in the dompurify documentation:

const clean = DOMPurify.sanitize(dirty, { USE_PROFILES: { html: true } });

Since the jquery code is using .html to paste HTML code directly into the DOM the code was previously to Cross-Site-Scripting here is a quick fix it is not perfect but it's a good temporary fix for the time being.
To import the library I used the dom purify CDN on the following link

My github description is an XSS payload if I search for my profile on social analyzer through the web GUI the description is parsed then sanitized:

My description:

"/><img src="somelink" onerror="alert(document.domain)" />

the output of social-analyzer

image

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant