melosh/mal
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: sanitize HTML to prevent XSS vulnerability

Browse Source
This commit is contained in:
mkelvers
2026-04-27 16:06:02 +02:00
parent e5c10e6fe0
commit 238599299f
3 changed files with 13 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
bun.lock
View File

@@ -4,6 +4,9 @@
"workspaces": { "workspaces": {
"": { "": {
"name": "myanimelist-ui", "name": "myanimelist-ui",
"dependencies": {
"dompurify": "^3.4.1",
},
"devDependencies": { "devDependencies": {
"@tailwindcss/cli": "^4.2.3", "@tailwindcss/cli": "^4.2.3",
"@toolwind/anchors": "^1.0.10", "@toolwind/anchors": "^1.0.10",
@@ -84,8 +87,12 @@
"@toolwind/anchors": ["@toolwind/anchors@1.0.10", "", { "peerDependencies": { "tailwindcss": ">=3.0.0 || >=4.0.0" } }, "sha512-F3J/lxGGPUy+GIpT49NmYMF1X7l0d7UzdDASni29il2ro5sT4cYfPBFHBAfOM0lpgKOr/HnqINlomngt8BcvnA=="], "@toolwind/anchors": ["@toolwind/anchors@1.0.10", "", { "peerDependencies": { "tailwindcss": ">=3.0.0 || >=4.0.0" } }, "sha512-F3J/lxGGPUy+GIpT49NmYMF1X7l0d7UzdDASni29il2ro5sT4cYfPBFHBAfOM0lpgKOr/HnqINlomngt8BcvnA=="],
"@types/trusted-types": ["@types/trusted-types@2.0.7", "", {}, "sha512-ScaPdn1dQczgbl0QFTeTOmVHFULt394XJgOQNoyVhZ6r2vLnMLJfBPd53SB52T/3G36VI1/g2MZaX0cwDuXsfw=="],
"detect-libc": ["detect-libc@2.1.2", "", {}, "sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ=="], "detect-libc": ["detect-libc@2.1.2", "", {}, "sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ=="],
"dompurify": ["dompurify@3.4.1", "", { "optionalDependencies": { "@types/trusted-types": "^2.0.7" } }, "sha512-JahakDAIg1gyOm7dlgWSDjV4n7Ip2PKR55NIT6jrMfIgLFgWo81vdr1/QGqWtFNRqXP9UV71oVePtjqS2ebnPw=="],
"enhanced-resolve": ["enhanced-resolve@5.20.1", "", { "dependencies": { "graceful-fs": "^4.2.4", "tapable": "^2.3.0" } }, "sha512-Qohcme7V1inbAfvjItgw0EaxVX5q2rdVEZHRBrEQdRZTssLDGsL8Lwrznl8oQ/6kuTJONLaDcGjkNP247XEhcA=="], "enhanced-resolve": ["enhanced-resolve@5.20.1", "", { "dependencies": { "graceful-fs": "^4.2.4", "tapable": "^2.3.0" } }, "sha512-Qohcme7V1inbAfvjItgw0EaxVX5q2rdVEZHRBrEQdRZTssLDGsL8Lwrznl8oQ/6kuTJONLaDcGjkNP247XEhcA=="],
"graceful-fs": ["graceful-fs@4.2.11", "", {}, "sha512-RbJ5/jmFcNNCcDV5o9eTnBLJ/HszWV0P73bc+Ff4nS/rJj+YaS6IGyiOL0VoBYX+l1Wrl3k63h/KrH+nhJ0XvQ=="], "graceful-fs": ["graceful-fs@4.2.11", "", {}, "sha512-RbJ5/jmFcNNCcDV5o9eTnBLJ/HszWV0P73bc+Ff4nS/rJj+YaS6IGyiOL0VoBYX+l1Wrl3k63h/KrH+nhJ0XvQ=="],

3
package.json
View File

@@ -14,5 +14,8 @@
"lefthook": "^2.1.6", "lefthook": "^2.1.6",
"tailwindcss": "^4.2.3", "tailwindcss": "^4.2.3",
"typescript": "^6.0.3" "typescript": "^6.0.3"
},
"dependencies": {
"dompurify": "^3.4.1"
} }
} }

4
static/player.ts
View File

@@ -4,6 +4,8 @@ declare const htmx: {
export {} export {}
import DOMPurify from 'dompurify'
interface ModeSource { interface ModeSource {
token: string token: string
subtitles: SubtitleItem[] subtitles: SubtitleItem[]
@@ -954,7 +956,7 @@ const loadNextEpisodeInPlace = async (animeID: number, nextEpisode: number): Pro
const html = await res.text() const html = await res.text()
const wrapper = document.createElement('span') const wrapper = document.createElement('span')
wrapper.id = 'watch-status-dropdown' wrapper.id = 'watch-status-dropdown'
wrapper.innerHTML = html wrapper.innerHTML = DOMPurify.sanitize(html)
watchStatusDropdown.replaceWith(wrapper) watchStatusDropdown.replaceWith(wrapper)
}).catch(() => {}) }).catch(() => {})
} }