Skip to content

Commit 761d575

Browse files
Lightning00Bladedevtools-frontend-scoped@luci-project-accounts.iam.gserviceaccount.com
authored andcommitted
[M149] Don't use innerHTML on user controlled data
Original change's description: > Don't use innerHTML on user controlled data > > The data is coming from untrusted source, so we should not > render the HTML parts. > > Fixed: 513758833 > Change-Id: I5c2d755ab29bc75da09b420f3df695a6dc6a880c > Reviewed-on: https://chromium-review.googlesource.com/c/devtools/devtools-frontend/+/7856912 > Auto-Submit: Nikolay Vitkov <nvitkov@chromium.org> > Commit-Queue: Nikolay Vitkov <nvitkov@chromium.org> > Reviewed-by: Alex Rudenko <alexrudenko@chromium.org> > Commit-Queue: Alex Rudenko <alexrudenko@chromium.org> (cherry picked from commit 22f74fb) Bug: 514928864,513758833 Change-Id: I5c2d755ab29bc75da09b420f3df695a6dc6a880c Reviewed-on: https://chromium-review.googlesource.com/c/devtools/devtools-frontend/+/7868746 Bot-Commit: rubber-stamper@appspot.gserviceaccount.com <rubber-stamper@appspot.gserviceaccount.com> Auto-Submit: chrome-cherry-picker@chops-service-accounts.iam.gserviceaccount.com <chrome-cherry-picker@chops-service-accounts.iam.gserviceaccount.com> Commit-Queue: rubber-stamper@appspot.gserviceaccount.com <rubber-stamper@appspot.gserviceaccount.com>
1 parent d48ac67 commit 761d575

1 file changed

Lines changed: 1 addition & 1 deletion

File tree

front_end/ui/components/suggestion_input/SuggestionInput.ts

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -83,7 +83,7 @@ class EditableContent extends HTMLElement {
8383
this.tabIndex = 0;
8484

8585
this.addEventListener('focus', () => {
86-
this.innerHTML = this.innerText;
86+
this.textContent = this.innerText;
8787
});
8888
this.addEventListener('blur', this.#highlight.bind(this));
8989
}

0 commit comments

Comments
 (0)