lee/puter
1
0
Fork 0
mirror of https://github.com/HeyPuter/puter.git synced 2026-08-27 00:16:44 +00:00
Code Issues Actions 9 Packages Projects Releases Wiki Activity

fix: escape folder names in Dashboard nav-history menu (stored XSS)

Browse Source 
The back/forward taphold menus interpolated path.basename(history_item)
straight into UIContextMenu item html, which renders it verbatim. A
folder named with an HTML/script payload executed when the user opened
the history menu after visiting it. The desktop file manager already
encodes this value; match it with html_encode(). Verified live: the
payload now renders as inert text and its onerror never fires.
This commit is contained in:
jelveh
2026-07-18 14:17:46 -07:00
parent 437305262e
commit 6c9c76ea57
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/gui/src/UI/Dashboard/TabFiles.js
+2 -2
View File
@@ -1046,7 +1046,7 @@ const TabFiles = {
const history_item = window.dashboard_nav_history[index];
items.push({
html: `<span>${history_item === window.home_path ? i18n('home') : path.basename(history_item)}</span>`,
html: `<span>${history_item === window.home_path ? i18n('home') : html_encode(path.basename(history_item))}</span>`,
val: index,
onClick: function (e) {
window.dashboard_nav_history_current_position = e.value;
@@ -1087,7 +1087,7 @@ const TabFiles = {
const history_item = window.dashboard_nav_history[index];
items.push({
html: `<span>${history_item === window.home_path ? i18n('home') : path.basename(history_item)}</span>`,
html: `<span>${history_item === window.home_path ? i18n('home') : html_encode(path.basename(history_item))}</span>`,
val: index,
onClick: function (e) {
window.dashboard_nav_history_current_position = e.value;