Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| resultMsg.innerHTML = `<b>File:</b> ${file.name}<br> | ||
| <b>Size:</b> ${(file.size / 1024 / 1024).toFixed(2)} MB<br> | ||
| <b>SHA-256:</b> ${fileHash}<br> | ||
| <b>UploadId:</b> ${uploadId}<br> | ||
| <b>Key:</b> ${key}<br> | ||
| <b>Chunks uploaded:</b> ${parts.length}<br> | ||
| <b>Final ETag:</b> ${completeResult.etag || 'N/A'}`; |
Check failure
Code scanning / CodeQL
DOM text reinterpreted as HTML High test
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 8 months ago
To fix the issue, the file name (file.name) and other dynamic data should be safely escaped before being inserted into the DOM using innerHTML. Escaping ensures that special characters in the file name (like <, >, &, etc.) are treated as plain text rather than HTML or JavaScript.
The best way to fix this is to use textContent instead of innerHTML, as textContent safely inserts text into the DOM without interpreting it as HTML. Alternatively, you can sanitize the dynamic data before using innerHTML, but using textContent is simpler and avoids the risk of improper sanitization.
Changes to be made:
- Replace all instances of
innerHTMLwhere untrusted data is interpolated withtextContent. - Specifically, update line 151 to ensure
file.nameand other interpolated values are safely added to the DOM as plain text.
| @@ -148,13 +148,13 @@ | ||
| // --- Done --- | ||
| statusMsg.textContent = 'Upload complete!'; | ||
| progressBar.style.width = '100%'; | ||
| resultMsg.innerHTML = `<b>File:</b> ${file.name}<br> | ||
| <b>Size:</b> ${(file.size / 1024 / 1024).toFixed(2)} MB<br> | ||
| <b>SHA-256:</b> ${fileHash}<br> | ||
| <b>UploadId:</b> ${uploadId}<br> | ||
| <b>Key:</b> ${key}<br> | ||
| <b>Chunks uploaded:</b> ${parts.length}<br> | ||
| <b>Final ETag:</b> ${completeResult.etag || 'N/A'}`; | ||
| resultMsg.textContent = `File: ${file.name}\n` + | ||
| `Size: ${(file.size / 1024 / 1024).toFixed(2)} MB\n` + | ||
| `SHA-256: ${fileHash}\n` + | ||
| `UploadId: ${uploadId}\n` + | ||
| `Key: ${key}\n` + | ||
| `Chunks uploaded: ${parts.length}\n` + | ||
| `Final ETag: ${completeResult.etag || 'N/A'}`; | ||
| } catch (err) { | ||
| showError(err.message || err); | ||
| } |
1 participant
Experiment with multipart upload