[security] XSS-fix: escape user-controlled data in innerHTML (#788) #839

Closed

sleepy wants to merge 0 commits from fix/xss-charname-innerhtml-788 into main

sleepy commented

2026-06-03 20:34:05 +02:00

Owner

Fixes #788 — XSS via unescaped innerHTML with user-controlled character names in chat.js. Replace innerHTML with safe DOM construction using textContent.

sleepy added 1 commit

2026-06-03 20:34:05 +02:00

[security] Fix XSS via unescaped innerHTML with user-controlled character names (#788 ) 46add0a845

Two innerHTML assignments in chat.js constructed role-label HTML by
interpolating roleLabel (which may contain a user-controlled character/
persona name from presetsModule.getCharacterName()). A malicious name
like <img src=x onerror=alert(1)> would execute when rendered.

Replace both innerHTML template constructions with safe DOM creation
using textContent for the user-controlled label text:

1. Stream-init holder (around line 1206) — main chat message creation
2. Background-stream holder (around line 3428) — background stream UI

Other innerHTML assignments in the same file are unaffected: they use
either hardcoded HTML, server-trusted markdown output, or already call
uiModule.esc(). chatRenderer.js already uses textContent for role text.

Closes #788

sleepy closed this pull request

2026-06-04 11:42:18 +02:00