Skip to content

fix: Update index.js DOM text reinterpreted as HTML#2329

Merged
NeilFraser merged 2 commits intoRaspberryPiFoundation:masterfrom
Shivam7-1:patch-4
Apr 19, 2024
Merged

fix: Update index.js DOM text reinterpreted as HTML#2329
NeilFraser merged 2 commits intoRaspberryPiFoundation:masterfrom
Shivam7-1:patch-4

Conversation

@Shivam7-1
Copy link
Contributor

By using innerText, it will avoid the risk of HTML injection, as these properties automatically escape any HTML special characters in the provided text. This helps prevent cross-site scripting (XSS) vulnerabilities by treating the input as plain text rather than interpreted HTML.

@Shivam7-1 Shivam7-1 requested a review from a team as a code owner April 19, 2024 11:02
@Shivam7-1 Shivam7-1 requested review from NeilFraser and removed request for a team April 19, 2024 11:02
@conventional-commit-lint-gcf
Copy link

🤖 I detect that the PR title and the commit message differ and there's only one commit. To use the PR title for the commit history, you can use Github's automerge feature with squashing, or use automerge label. Good luck human!

-- conventional-commit-lint bot
https://conventionalcommits.org/

@Shivam7-1
Copy link
Contributor Author

Hi @NeilFraser Could You Please Review this PR
Thanks

@NeilFraser
Copy link
Contributor

Google bans use of assignment to innerHTML - with the exception of the empty string. That said, there's no harm in changing this.

However, textContent is vastly preferred over innerText: https://kellegous.com/j/2013/02/27/innertext-vs-textcontent/

@Shivam7-1
Copy link
Contributor Author

Hi @NeilFraser Thanks for Reviewing
As per Suggestion In had used textContent instead of innertext

Regards

@NeilFraser NeilFraser merged commit 69bfafc into RaspberryPiFoundation:master Apr 19, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants