The drag-and-drop loader accepts arbitrary JSON records, carries sessionId into the session view model, and interpolates it unescaped into a data-id attribute in variant 1.
References:
index.html:759-811index.html:900-910index.html:1891-1907
Other record-derived strings in the same renderer use esc, but s.sessionId does not.
Failure scenario: a downloaded or shared usage JSON file contains a session ID such as a quote followed by an event-handler attribute. When the user drops that file onto the page while variant 1 is active, assigning the generated string to innerHTML creates executable markup. The script runs in the page origin and can read cached usage records and subscription settings from localStorage.
Suggested direction: escape the attribute value at minimum, preferably build rows with DOM APIs and event listeners instead of inline HTML handlers. Add a regression test with quotes and markup in every record-derived field accepted by the drop loader.
The drag-and-drop loader accepts arbitrary JSON records, carries
sessionIdinto the session view model, and interpolates it unescaped into adata-idattribute in variant 1.References:
index.html:759-811index.html:900-910index.html:1891-1907Other record-derived strings in the same renderer use
esc, buts.sessionIddoes not.Failure scenario: a downloaded or shared usage JSON file contains a session ID such as a quote followed by an event-handler attribute. When the user drops that file onto the page while variant 1 is active, assigning the generated string to
innerHTMLcreates executable markup. The script runs in the page origin and can read cached usage records and subscription settings from localStorage.Suggested direction: escape the attribute value at minimum, preferably build rows with DOM APIs and event listeners instead of inline HTML handlers. Add a regression test with quotes and markup in every record-derived field accepted by the drop loader.