Sanitize SVG title attribute in podcastChannel.html

kagemomiji · Jul 20, 2024 · 02efcbd · 02efcbd
1 parent e44911f
commit 02efcbd
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/airsonic-main/src/main/resources/templates/podcastChannel.html b/airsonic-main/src/main/resources/templates/podcastChannel.html
@@ -54,7 +54,7 @@
 
             feather.replace();
             Array.from(document.querySelectorAll('svg.feather[title]')).forEach((element) => {
-               element.insertAdjacentHTML('afterbegin', `<title>${element.attributes.title.value}</title>`);
+               element.insertAdjacentHTML('afterbegin', `<title>${DOMPurify.sanitize(element.attributes.title.value)}</title>`);
             });
             countSelected();
         }