Skip to content

Security: replace innerHTML with safe DOM rendering in auth navbar#447

Open
parakramgambhir14 wants to merge 1 commit into
PatelHarsh2006:mainfrom
parakramgambhir14:fix/auth-navbar-xss
Open

Security: replace innerHTML with safe DOM rendering in auth navbar#447
parakramgambhir14 wants to merge 1 commit into
PatelHarsh2006:mainfrom
parakramgambhir14:fix/auth-navbar-xss

Conversation

@parakramgambhir14
Copy link
Copy Markdown

@parakramgambhir14 parakramgambhir14 commented Jun 3, 2026

  • This PR fixes a DOM-based XSS vulnerability in the authentication navbar and profile rendering system.
  • Previously, user data (name and email) was injected into the DOM using unsafe HTML rendering methods. This could potentially allow script injection if malicious data is stored in localStorage.

closes #448

Fix

  • Replaced unsafe HTML rendering with safe DOM APIs
  • Used textContent for all user-controlled fields
  • Ensured authentication UI renders without executing injected HTML

Security Impact

  • Removes DOM-based XSS risk in authentication-related UI components.

@parakramgambhir14
Copy link
Copy Markdown
Author

parakramgambhir14 commented Jun 4, 2026

Hey @PatelHarsh2006 , This PR is under GSSoC'2026. Kindly add the relevant tag.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Stored/DOM XSS in Authentication Navbar

2 participants