tamperchrome
tamperchrome copied to clipboard
google
DOM text reinterpreted as HTML Update inject.js
By using innerText, it will avoid the risk of HTML injection, as these properties automatically escape any HTML special characters in the provided text. This helps prevent cross-site scripting (XSS) vulnerabilities by treating the input as plain text rather than interpreted HTML. Always be cautious when dealing with user input or dynamic content to prevent security risks.
In this case innerHTML is being used as a getter, not a setter, so the existing code is perfectly safe. Further, it appears that changing this to text-only would break the following match, which seems to be looking for HTML attributes.
