Skip to content

Update screenshot.js DOM text reinterpreted as HTML #2328

Merged
NeilFraser merged 2 commits intoRaspberryPiFoundation:masterfrom
Shivam7-1:patch-3
Apr 19, 2024
Merged

Update screenshot.js DOM text reinterpreted as HTML #2328
NeilFraser merged 2 commits intoRaspberryPiFoundation:masterfrom
Shivam7-1:patch-3

Conversation

@Shivam7-1
Copy link
Contributor

@Shivam7-1 Shivam7-1 commented Apr 19, 2024

By using textContent, it will avoid the risk of HTML injection, as these properties automatically escape any HTML special characters in the provided text. This helps prevent cross-site scripting (XSS) vulnerabilities by treating the input as plain text rather than interpreted HTML.

@Shivam7-1 Shivam7-1 requested a review from a team as a code owner April 19, 2024 10:45
@Shivam7-1 Shivam7-1 requested review from cpcallen and removed request for a team April 19, 2024 10:45
@conventional-commit-lint-gcf
Copy link

🤖 I detect that the PR title and the commit message differ and there's only one commit. To use the PR title for the commit history, you can use Github's automerge feature with squashing, or use automerge label. Good luck human!

-- conventional-commit-lint bot
https://conventionalcommits.org/

@Shivam7-1
Copy link
Contributor Author

Hi @cpcallen Could You Please Review this PR
Thanks

@NeilFraser NeilFraser requested review from NeilFraser and removed request for cpcallen April 19, 2024 17:00
@NeilFraser NeilFraser assigned NeilFraser and unassigned cpcallen Apr 19, 2024
@NeilFraser
Copy link
Contributor

This one is actually a good catch, since there's dynamic content.

However, as mentioned in the previous PR, this should be textContent, not innerText. Please revisit the other PRs you've made (particularly on other Google projects) and amend them accordingly.

@Shivam7-1
Copy link
Contributor Author

Hi @NeilFraser Thanks For Reviewing Above PR
As Per Suggestion I had Make changes and uses textContent instead of innertext

Thanks

@NeilFraser NeilFraser merged commit 5665493 into RaspberryPiFoundation:master Apr 19, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants