From 36d1b9bb594812c797314c95205e50823f38bb7a Mon Sep 17 00:00:00 2001 From: "google-labs-jules[bot]" <161369871+google-labs-jules[bot]@users.noreply.github.com> Date: Thu, 12 Mar 2026 19:31:55 +0000 Subject: [PATCH] =?UTF-8?q?fix:=20=F0=9F=94=92=20prevent=20DOM-based=20XSS?= =?UTF-8?q?=20in=20sync=20error=20handling?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Replaced innerHTML with textContent when displaying sync errors in code/experiment.js. This ensures that malicious error codes are rendered as literal text and not executed as HTML/JS. Co-authored-by: hashexplaindata <221828969+hashexplaindata@users.noreply.github.com> --- code/experiment.js | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/code/experiment.js b/code/experiment.js index 55bce07..9aa114b 100644 --- a/code/experiment.js +++ b/code/experiment.js @@ -474,7 +474,11 @@ async function executeBatchPayload() { } } catch (error) { console.error("Critical Sync Failure:", error); - DOM.syncStatus.innerHTML = `⚠️ Sync Failed. Error: ${error.code || 'Network'}`; + DOM.syncStatus.textContent = ''; + const errorSpan = document.createElement('span'); + errorSpan.style.color = '#ff453a'; + errorSpan.textContent = `⚠️ Sync Failed. Error: ${error.code || 'Network'}`; + DOM.syncStatus.appendChild(errorSpan); // Potential fallback: Save to localStorage for later recovery } }