🔴 3. XSS Vulnerability: Unescaped HTML Injection

[juancolchete]

Location: templates/add_area.html:474

document.getElementById("sugestions").innerHTML = `suggested logo: ${prefilledCommunityData.icon}`

Problem: Directly inserting untrusted data from Gitea issue into .innerHTML without sanitization.

Fix:

// Option 1: Use textContent
document.getElementById("sugestions").textContent = `suggested logo: ${prefilledCommunityData.icon}`

// Option 2: Sanitize if HTML is needed
function sanitizeHTML(str) {
    const temp = document.createElement('div')
    temp.textContent = str
    return temp.innerHTML
}
document.getElementById("sugestions").innerHTML = `suggested logo: ${sanitizeHTML(prefilledCommunityData.icon)}`