-
Notifications
You must be signed in to change notification settings - Fork 22
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
chore: bpt_dmvschool 🚑 Fix some errors, and refactor code #851
Conversation
break; | ||
} | ||
} | ||
$(oneRow).appendTo('#transactions-container'); |
Check failure
Code scanning / CodeQL
Client-side cross-site scripting High
user-provided value
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI about 1 month ago
To fix the cross-site scripting vulnerability, we need to ensure that any user-provided data is properly sanitized or escaped before being inserted into the DOM. The best way to fix this issue is to use a library like DOMPurify
to sanitize the HTML content before appending it to the DOM.
- Import the
DOMPurify
library. - Sanitize the
oneRow
HTML string before appending it to the DOM.
-
Copy modified line R1 -
Copy modified lines R437-R438
@@ -1 +1,2 @@ | ||
import DOMPurify from 'dompurify'; | ||
let LOADED = true; | ||
@@ -435,3 +436,4 @@ | ||
|
||
$(oneRow).appendTo('#transactions-container'); | ||
const sanitizedRow = DOMPurify.sanitize(oneRow); | ||
$(sanitizedRow).appendTo('#transactions-container'); | ||
} |
-
Copy modified lines R4-R6
@@ -3,2 +3,5 @@ | ||
"eslint": "^9.11.1" | ||
}, | ||
"dependencies": { | ||
"dompurify": "^3.1.7" | ||
} |
Package | Version | Security advisories |
dompurify (npm) | 3.1.7 | None |
`${this.language.moneyFormat.replace( | ||
'__replaceData__', | ||
newData.money, | ||
)} `, |
Check failure
Code scanning / CodeQL
Client-side cross-site scripting High
user-provided value
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI about 1 month ago
To fix the cross-site scripting vulnerability, we need to ensure that any user-provided data is properly sanitized or escaped before being inserted into the HTML. The best way to achieve this is by using a library like DOMPurify
to sanitize the data.
- General Fix: Use
DOMPurify
to sanitize the user-provided data before inserting it into the HTML. - Detailed Fix:
- Import the
DOMPurify
library. - Use
DOMPurify.sanitize
to sanitize thenewData.money
andnewData.bankMoney
values before inserting them into the HTML.
- Import the
-
Copy modified line R1 -
Copy modified line R452 -
Copy modified line R458
@@ -1 +1,2 @@ | ||
import DOMPurify from 'dompurify'; | ||
let LOADED = true; | ||
@@ -450,3 +451,3 @@ | ||
'__replaceData__', | ||
newData.money, | ||
DOMPurify.sanitize(newData.money), | ||
)} `, | ||
@@ -456,3 +457,3 @@ | ||
'__replaceData__', | ||
newData.bankMoney, | ||
DOMPurify.sanitize(newData.bankMoney), | ||
)}`, |
-
Copy modified lines R4-R6
@@ -3,2 +3,5 @@ | ||
"eslint": "^9.11.1" | ||
}, | ||
"dependencies": { | ||
"dompurify": "^3.1.7" | ||
} |
Package | Version | Security advisories |
dompurify (npm) | 3.1.7 | None |
`${this.language.moneyFormat.replace( | ||
'__replaceData__', | ||
newData.bankMoney, | ||
)}`, |
Check failure
Code scanning / CodeQL
Client-side cross-site scripting High
user-provided value
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI about 1 month ago
To fix the cross-site scripting vulnerability, we need to ensure that any user-provided data is properly sanitized or escaped before being inserted into the HTML. One effective way to do this is by using a library like DOMPurify, which can sanitize HTML and prevent XSS attacks.
- General Fix: Sanitize the
newData
before using it to update the HTML content. - Detailed Fix: Import the DOMPurify library and use it to sanitize the
newData.money
andnewData.bankMoney
values before inserting them into the HTML. - Files/Regions/Lines to Change: Modify the
refresh
method in theserver-data/resources/[bpt_addons]/bpt_banking/html/scripts/app.js
file, specifically around lines 455 and 457. - Needed: Import the DOMPurify library, sanitize the
newData
values before using them in thereplace
method.
-
Copy modified line R1 -
Copy modified line R452 -
Copy modified line R458
@@ -1 +1,2 @@ | ||
import DOMPurify from 'dompurify'; | ||
let LOADED = true; | ||
@@ -450,3 +451,3 @@ | ||
'__replaceData__', | ||
newData.money, | ||
DOMPurify.sanitize(newData.money), | ||
)} `, | ||
@@ -456,3 +457,3 @@ | ||
'__replaceData__', | ||
newData.bankMoney, | ||
DOMPurify.sanitize(newData.bankMoney), | ||
)}`, |
-
Copy modified lines R4-R6
@@ -3,2 +3,5 @@ | ||
"eslint": "^9.11.1" | ||
}, | ||
"dependencies": { | ||
"dompurify": "^3.1.7" | ||
} |
Package | Version | Security advisories |
dompurify (npm) | 3.1.7 | None |
Fixes #[issue_no]
All Submissions:
Please describe the changes this PR makes and why it should be merged:
Discord username (if different from GitHub):