🔒 Fix DOM-based XSS in InvestAI.html Rendering#2
Conversation
This commit addresses several DOM-based XSS vulnerabilities in the `InvestAI.html` file. The core fix involves:
- Introducing a helper function `esc(str)` to escape HTML entities (`&`, `<`, `>`, `"`, `'`).
- Applying `esc()` to all dynamic data interpolated into `innerHTML` sinks, including:
- Portfolio data (tickers, asset names, comments, dates).
- AI-generated analysis text and summaries.
- Error messages in the `runAnalysis` function.
- User profile labels (Risk and Horizon).
These changes ensure that untrusted input from the user or the AI analysis is rendered as plain text, preventing malicious script execution in the browser.
Verification:
- Logic verified with Node.js unit tests (`verify_fix.js`).
- Frontend verified with Playwright (`verify_xss_fix.py`), confirming that injected HTML tags are correctly escaped in the DOM.
Co-authored-by: FelipeDupas <118365943+FelipeDupas@users.noreply.github.com>
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
1 participant
This PR fixes a critical security vulnerability where user-controlled or AI-generated data was being rendered directly into the DOM using
innerHTML, potentially allowing for Cross-Site Scripting (XSS) attacks.🎯 What:
I've implemented a robust HTML escaping mechanism within
InvestAI.htmland applied it to all dynamic data rendering points.Previously, an attacker could potentially inject malicious scripts through portfolio item names, tickers, or even by manipulating AI responses if they could influence the analysis engine. This could lead to unauthorized actions on behalf of the user or theft of sensitive session information.
🛡️ Solution:
esc(str)function that converts HTML special characters into their respective entities.innerHTMLinterpolation to wrap dynamic data inesc().PR created automatically by Jules for task 5767870438976296475 started by @FelipeDupas