f-denkena/rclone
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: fix XSS vulnerability in dropdown mobile header

Browse Source 
Use textContent instead of innerHTML when inserting the dropdown
label to prevent DOM text being reinterpreted as HTML.

Fixes https://github.com/rclone/rclone/security/code-scanning/176
This commit is contained in:
Nick Craig-Wood
2026-04-08 09:19:10 +01:00
parent f757e6c0a7
commit d58ce7b1b7
1 changed files with 7 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/static/js/rclone.js
Vendored
+7 -1
View File
@@ -45,7 +45,13 @@
// Mobile close header
var header = document.createElement("div");
header.className = "dropdown-mobile-header";
header.innerHTML = '<span>' + label + '</span><span class="dropdown-mobile-close">&times;</span>';
var labelSpan = document.createElement("span");
labelSpan.textContent = label;
var closeSpan = document.createElement("span");
closeSpan.className = "dropdown-mobile-close";
closeSpan.innerHTML = "&times;";
header.appendChild(labelSpan);
header.appendChild(closeSpan);
menu.insertBefore(header, menu.firstChild);
header.addEventListener("click", function() {
menu.classList.remove("show");