DOM text reinterpreted as HTML Update background.js

Open Shivam7-1 opened this issue 2 years ago • 3 comments

By using innerText, it will avoid the risk of HTML injection, as these properties automatically escape any HTML special characters in the provided text. This helps prevent cross-site scripting (XSS) vulnerabilities by treating the input as plain text rather than interpreted HTML. Always be cautious when dealing with user input or dynamic content to prevent security risks.

Apr 16 '24 12:04 Shivam7-1

Hi @sirdarckcat Could You Please Review this PR Thanks

Apr 18 '24 17:04 Shivam7-1

Hi @sirdarckcat Could You Please Review this PR

Thanks

Apr 19 '24 16:04 Shivam7-1

I'm not on this project's team, but this PR would result in raw HTML being printed on the user's screen. Here innerHTML is being used intentionally since there's an <H1> tag.

Apr 19 '24 17:04 NeilFraser