Skip to content

🔒 [security fix] Fix DOM-based XSS in error handling #7

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
hashexplaindata wants to merge 1 commit into from
Closed

🔒 [security fix] Fix DOM-based XSS in error handling #7

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 5 additions & 1 deletion code/experiment.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -474,7 +474,11 @@ async function executeBatchPayload() {
}
} catch (error) {
console.error("Critical Sync Failure:", error);
DOM.syncStatus.innerHTML = `<span style="color:#ff453a">⚠️ Sync Failed. Error: ${error.code || 'Network'}</span>`;
DOM.syncStatus.textContent = '';
const errorSpan = document.createElement('span');
errorSpan.style.color = '#ff453a';
errorSpan.textContent = `⚠️ Sync Failed. Error: ${error.code || 'Network'}`;

Copilot AI Mar 12, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Using error.code || 'Network' will replace valid falsy codes (e.g., 0 or an empty string) with 'Network'. Prefer nullish coalescing (error.code ?? 'Network') to only fall back when code is null/undefined so the displayed error remains accurate.

Suggested change
errorSpan.textContent = `⚠️ Sync Failed. Error: ${error.code || 'Network'}`;
errorSpan.textContent = `⚠️ Sync Failed. Error: ${error.code ?? 'Network'}`;

Copilot uses AI. Check for mistakes.
DOM.syncStatus.appendChild(errorSpan);
Comment on lines +477 to +481

@gemini-code-assist gemini-code-assist Bot Mar 12, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

While this correctly fixes the XSS vulnerability, the implementation can be simplified. Instead of clearing the container and appending a new styled span, you can directly set the textContent and style.color of the DOM.syncStatus element. This approach is more concise and achieves the same visual result.

Suggested change
DOM.syncStatus.textContent = '';
const errorSpan = document.createElement('span');
errorSpan.style.color = '#ff453a';
errorSpan.textContent = `⚠️ Sync Failed. Error: ${error.code || 'Network'}`;
DOM.syncStatus.appendChild(errorSpan);
DOM.syncStatus.textContent = `⚠️ Sync Failed. Error: ${error.code || 'Network'}`;
DOM.syncStatus.style.color = '#ff453a';

// Potential fallback: Save to localStorage for later recovery
}
}
Expand Down
Loading