From 6c9c76ea57c05e627be11c266239aaa971cfd755 Mon Sep 17 00:00:00 2001 From: jelveh Date: Sat, 18 Jul 2026 14:17:46 -0700 Subject: [PATCH] fix: escape folder names in Dashboard nav-history menu (stored XSS) The back/forward taphold menus interpolated path.basename(history_item) straight into UIContextMenu item html, which renders it verbatim. A folder named with an HTML/script payload executed when the user opened the history menu after visiting it. The desktop file manager already encodes this value; match it with html_encode(). Verified live: the payload now renders as inert text and its onerror never fires. --- src/gui/src/UI/Dashboard/TabFiles.js | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/gui/src/UI/Dashboard/TabFiles.js b/src/gui/src/UI/Dashboard/TabFiles.js index ff756aaf6..feca8558c 100644 --- a/src/gui/src/UI/Dashboard/TabFiles.js +++ b/src/gui/src/UI/Dashboard/TabFiles.js @@ -1046,7 +1046,7 @@ const TabFiles = { const history_item = window.dashboard_nav_history[index]; items.push({ - html: `${history_item === window.home_path ? i18n('home') : path.basename(history_item)}`, + html: `${history_item === window.home_path ? i18n('home') : html_encode(path.basename(history_item))}`, val: index, onClick: function (e) { window.dashboard_nav_history_current_position = e.value; @@ -1087,7 +1087,7 @@ const TabFiles = { const history_item = window.dashboard_nav_history[index]; items.push({ - html: `${history_item === window.home_path ? i18n('home') : path.basename(history_item)}`, + html: `${history_item === window.home_path ? i18n('home') : html_encode(path.basename(history_item))}`, val: index, onClick: function (e) { window.dashboard_nav_history_current_position = e.value;