Potential fix for code scanning alert no. 59: DOM text reinterpreted as HTML#19
Conversation
mokesano
added
bug
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3c68456caa
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| contentSpan.className = 'u-ml-16'; | ||
|
|
||
| const p = document.createElement('p'); | ||
| p.textContent = highlight; |
There was a problem hiding this comment.
Assigning highlight via textContent makes any inline HTML in the generated summary render literally. In this file, highlights are derived from abstractElement.innerHTML, so abstracts containing tags/entities (for example <sub>, <i>, or α) will now display raw markup text to users instead of readable output. This is a user-visible regression introduced by the change; sanitize/normalize the abstract to plain text before scoring/generation to keep the XSS fix without degrading display.
Useful? React with 👍 / 👎.
…as HTML Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
mokesano
force-pushed
the
alert-autofix-59
branch
from
4116d22 to
fe2f206
Compare
2 participants
Potential fix for https://github.com/mokesano/editorial-pro/security/code-scanning/59
The safest fix without changing functionality is to stop concatenating unescaped dynamic strings into HTML. Build the list using DOM APIs (
createElement,textContent,appendChild) so highlight text is always inserted as text, not interpreted as HTML.Best concrete change in
plugins/themes/sangiapub/js/ArticleHighlight_v1.js:displayArticleHighlights(), replace thehtmlstring construction loop andhighlightsElement.innerHTML = html;.li.react-xocs-list-item,span.list-label,span.u-ml-16, nestedp).highlightsElement.textContent = '') and append constructed nodes.highlight.No new imports or external dependencies are needed.
Suggested fixes powered by Copilot Autofix. Review carefully before merging.