Skip to content

Conversation

@rgantzos
Copy link
Collaborator

No description provided.

@rgantzos rgantzos merged commit 0712260 into STForScratch:main Dec 13, 2022
"0"
);
var div = document.createElement("div");
div.innerHTML = divText;

Check warning

Code scanning / CodeQL

Client-side cross-site scripting

Cross-site scripting vulnerability due to [user-provided value](1).
document.getElementsByClassName("inner mod-splash")[1].firstChild.firstChild
.firstChild;
Name = text.innerText.split(" ")[3];
text.innerHTML = `Projects Curated by <a href='https://scratch.mit.edu/users/${Name}/'>${Name}</a>`;

Check warning

Code scanning / CodeQL

DOM text reinterpreted as HTML

[DOM text](1) is reinterpreted as HTML without escaping meta-characters.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant