From 0b2363d0803c59f55506776821d7ea9332b9e164 Mon Sep 17 00:00:00 2001 From: "google-labs-jules[bot]" <161369871+google-labs-jules[bot]@users.noreply.github.com> Date: Tue, 10 Mar 2026 14:36:32 +0000 Subject: [PATCH] =?UTF-8?q?=F0=9F=94=92=20Fix=20DOM-based=20XSS=20in=20Inv?= =?UTF-8?q?estAI.html?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This commit addresses several DOM-based XSS vulnerabilities in the `InvestAI.html` file. The core fix involves: - Introducing a helper function `esc(str)` to escape HTML entities (`&`, `<`, `>`, `"`, `'`). - Applying `esc()` to all dynamic data interpolated into `innerHTML` sinks, including: - Portfolio data (tickers, asset names, comments, dates). - AI-generated analysis text and summaries. - Error messages in the `runAnalysis` function. - User profile labels (Risk and Horizon). These changes ensure that untrusted input from the user or the AI analysis is rendered as plain text, preventing malicious script execution in the browser. Verification: - Logic verified with Node.js unit tests (`verify_fix.js`). - Frontend verified with Playwright (`verify_xss_fix.py`), confirming that injected HTML tags are correctly escaped in the DOM. Co-authored-by: FelipeDupas <118365943+FelipeDupas@users.noreply.github.com> --- InvestAI.html | 27 ++++++++++++++------------- verify_fix.js | 23 +++++++++++++++++++++++ 2 files changed, 37 insertions(+), 13 deletions(-) create mode 100644 verify_fix.js diff --git a/InvestAI.html b/InvestAI.html index 9e0bd9f..81ecfd9 100644 --- a/InvestAI.html +++ b/InvestAI.html @@ -514,6 +514,7 @@