Skip to content

fix(security): sanitize user-controlled content and escape DOM sinks - #3117

Open
sazedul-haque wants to merge 3 commits into
4.2.0from
dom-xss-fixes
Open

fix(security): sanitize user-controlled content and escape DOM sinks#3117
sazedul-haque wants to merge 3 commits into
4.2.0from
dom-xss-fixes

Conversation

@sazedul-haque

@sazedul-haque sazedul-haque commented Oct 23, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

Fixes several DOM XSS and injection vulnerabilities across front-end and admin scripts by sanitizing user-controlled inputs before injecting into DOM/RegExp sinks:

  1. Withdraw modal: Escape accountName and amount using tutor_esc_html() before inserting into the modal HTML.
  2. Image preview: Set user file name as plain text instead of parsing as HTML.
  3. Course archive: Escape user-supplied filter names when querying DOM elements to prevent jQuery selector injection.
  4. Course spotlight & curriculum: Sanitize user-controlled content rendering.
  5. Segment search: Escape regex metacharacters in segment search queries before instantiating dynamic RegExp.

@sazedul-haque
fix(security): sanitize withdraw modal accountName and amount with tu…
a813793 
…tor_esc_html (SEC-04)
@sazedul-haque
Escape user-controlled content in UI
289a4f2 
Render file names and course content as text instead of HTML, and match filter fields by their name property to avoid interpolating names into selectors.
@sazedul-haque
Escape segment search terms in regex
1046bcf 
Treat search input as literal text when matching segment fields, preventing regex metacharacters from causing errors or unintended matches.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@b-l-i-n-d b-l-i-n-d b-l-i-n-d approved these changes
@shewa12 shewa12 Awaiting requested review from shewa12
@harunollyo harunollyo Awaiting requested review from harunollyo

Assignees

No one assigned

Labels

4.2.0

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@sazedul-haque @b-l-i-n-d