Security: No input validation on localStorage data — XSS via third-party script

[Siddh2024]

Summary

CubeIt is a pure frontend PWA with no backend. All solve data is stored in localStorage via src/App.jsx:381 without integrity checking. A malicious browser extension or compromised third-party script (e.g., font CDN loaded at lines 460-467) can manipulate solve data or inject XSS.

Details

• File: src/App.jsx lines 381, 460-467
• Solve history, scramble sequences, session data stored as raw JSON in localStorage
• Google Fonts loaded dynamically from CDN — a compromised CDN could inject malicious code
• No input validation before writing to or reading from localStorage

Impact

Malicious extensions or compromised CDN scripts can inject arbitrary code via stored scramble strings that may be rendered into the DOM, leading to XSS.

Suggested Fix

1. Validate all data read from localStorage before rendering
2. Use Subresource Integrity (SRI) tags for CDN resources
3. Sanitize any user-visible data before DOM insertion