New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

CWE-79 (Dangerous dynamic HTML insert detected) reported by Bearer #143

Open

nicbet opened this issue Dec 21, 2023 · 0 comments

nicbet commented Dec 21, 2023

Security scanner bearer/bearer reports the following issue:

CRITICAL: Dangerous dynamic HTML insert detected. [CWE-79]
https://docs.bearer.com/reference/rules/javascript_lang_dangerous_insert_html

File: autocomplete_controller.js:232

 232     this.resultsTarget.innerHTML = html

originating out of the replaceResults(html) function called by fetchResults(query).

Looking at github/auto-complete-element it appears that it's using a similar fetch call, but with a recommendation to use DOMPurify and a CSP Trusted Types policy to sanitize the HTML returned by the fetch response before inserting it into the DOM sink with .innerHTML (https://github.com/github/auto-complete-element?tab=readme-ov-file#csp-trusted-types / https://web.dev/articles/trusted-types#use_a_library)

I'm wondering whether the current implementation of this library is vulnerable to an XSS?

The text was updated successfully, but these errors were encountered:

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment