Skip to content

Commit

Permalink
Improve message encoding in js-mailer
Browse files Browse the repository at this point in the history
Changed the code to encode the error message text in js-mailer.js. This is done to prevent potential Cross-Site Scripting (XSS) by ensuring any HTML characters entering the message div are properly escaped.
  • Loading branch information
wneessen committed Mar 20, 2024
1 parent 2721f1f commit 7127e17
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion code-examples/js-mailer.js
Original file line number Diff line number Diff line change
Expand Up @@ -100,6 +100,6 @@ function showError(errorMsg) {
return false
}
msgDiv.innerText = errorMsg
msgDiv.innerHTML = msgDiv.innerText + '<button type="button" class="btn-close" data-bs-dismiss="alert" aria-label="Close"></button>'
msgDiv.innerHTML = encodeURIComponent(msgDiv.innerText) + '<button type="button" class="btn-close" data-bs-dismiss="alert" aria-label="Close"></button>'
msgDiv.style.display = 'block'
}

0 comments on commit 7127e17

Please sign in to comment.