Skip to content

Monitoring metrics: remove sanitizeString#2886

Closed
lifenjoiner wants to merge 1 commit into
DNSCrypt:masterfrom
lifenjoiner:metrics
Closed

Monitoring metrics: remove sanitizeString#2886
lifenjoiner wants to merge 1 commit into
DNSCrypt:masterfrom
lifenjoiner:metrics

Conversation

@lifenjoiner

Copy link
Copy Markdown
Member
  • The client assigns the values to textContent of DOM elements.
  • A malicious user can only control the queried name, other values are from the app itself.
  • Debug logs and Prometheus metrics need original value.
  • The admin need to see the original value.

Fix #2885.

I feel like we’ve been fixing up after AI lately.

* The client assigns the values to `textContent` of DOM elements.
* A malicious user can only control the queried name, other values are
  from the app itself.
* Debug logs and Prometheus metrics need original value.
* The admin need to see the original value.

Fix DNSCrypt#2885.
@lifenjoiner

Copy link
Copy Markdown
Member Author

The monitoring.js assigns the value to textContent of DOM elements. I don't think there will be XSS attacks. Did I miss anything?

@jedisct1 jedisct1 closed this in d600edd Jun 14, 2025
@lifenjoiner lifenjoiner deleted the metrics branch June 22, 2025 11:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Conjoined address:port in dashboard

1 participant