-
Notifications
You must be signed in to change notification settings - Fork 618
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
fix: update screenshot.js DOM text reinterpreted as HTML #2322
Conversation
🤖 I detect that the PR title and the commit message differ and there's only one commit. To use the PR title for the commit history, you can use Github's automerge feature with squashing, or use -- conventional-commit-lint bot |
Hi @rachel-fenichel Could You Please Review this PR |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Honestly can't figure out what this code is currently achieving by copying all of the text area value
s to the innerHTML
. But can't hurt to change it over to innerText
(especially when this should only be used for testing and not in production).
Hi @BeksOmega Thanks For Reviewing Thanks |
Nope you're all good @Shivam7-1 =) Thank you for the fix! |
I agree @BeksOmega, this code (before or after this change) makes no sense to me. If the contents of these textareas are supposed to contain HTML code, then it was a vulnerability, and it is now broken. But I can't figure out where these textareas are. Anyone know how to test this? There's no mention of screenshots in the readme for this plugin. |
You can right click the workspace and hit "download screenshot". Even if you comment out this code, it appears the screenshot still works (all text is included). I dug back into the history, but Sam committed it whole cloth to core, and there were no comments on the PR about this code. |
By using innerText, it will avoid the risk of HTML injection, as these properties automatically escape any HTML special characters in the provided text. This helps prevent cross-site scripting (XSS) vulnerabilities by treating the input as plain text rather than interpreted HTML. Always be cautious when dealing with user input or dynamic content to prevent security risks.