Skip to content

Fix XSS security vulnerability - #89

Open
pcworld wants to merge 1 commit into
davatron5000:masterfrom
pcworld:xss-fix
Open

pcworld wants to merge 1 commit into
davatron5000:masterfrom
pcworld:xss-fix

Conversation

@pcworld

@pcworld pcworld commented Apr 26, 2020

Copy link
Copy Markdown

Using textContent instead of appending to HTML ensures that escaped HTML
characters stay escaped.
Fixes issue #88

Using textContent instead of appending to HTML ensures that escaped HTML
characters stay escaped.
Fixes issue davatron5000#88
@dajiaohuang

dajiaohuang commented Sep 22, 2026 •

Copy link
Copy Markdown

While validating this change, I found a regression in the current head: assigning t.innerHTML = '' does not clear the element because t is a jQuery wrapper. A second call then retains the original text and appends the generated spans. Minimal reproduction: jQuery('

Rainbow
').lettering() produces RainbowRainbow on the PR head, while upstream produces Rainbow. In lines mode the sentinel also remains visible. Replacing that assignment with t.empty() clears the target before appending the textContent spans.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants