🔒 [security fix] Fix DOM-based XSS in error handling by hashexplaindata · Pull Request #7 · hashexplaindata/Conformity-experiment

hashexplaindata · 2026-03-12T19:32:04Z

🎯 What: Fixed a DOM-based XSS vulnerability in the error handling logic.
⚠️ Risk: A malicious actor or compromised backend could inject executable scripts via the error code, leading to session hijacking or data theft.
🛡️ Solution: Switched from innerHTML to textContent for rendering error messages, ensuring all dynamic content is safely treated as plain text.

PR created automatically by Jules for task 4553460164316150800 started by @hashexplaindata

Replaced innerHTML with textContent when displaying sync errors in code/experiment.js. This ensures that malicious error codes are rendered as literal text and not executed as HTML/JS. Co-authored-by: hashexplaindata <221828969+hashexplaindata@users.noreply.github.com>

google-labs-jules · 2026-03-12T19:32:06Z

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

For security, I will only act on instructions from the user who triggered this task.

gemini-code-assist · 2026-03-12T19:32:16Z

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request implements a critical security fix to prevent DOM-based Cross-Site Scripting (XSS) in the application's error handling mechanism. By switching from direct innerHTML manipulation to safer textContent assignment and explicit DOM element creation, the change ensures that error messages are rendered as plain text, mitigating the risk of malicious script injection and potential session hijacking or data theft.

Highlights

Security Fix: Addressed a DOM-based XSS vulnerability in error handling by replacing innerHTML with textContent for rendering error messages.
DOM Manipulation Safety: Refactored error message display to explicitly create and append a <span> element, setting its textContent to ensure dynamic content is treated as plain text.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request effectively resolves a DOM-based XSS vulnerability by replacing the use of innerHTML with safer DOM manipulation methods when displaying error messages. The change is correct and addresses the security risk. I have provided one suggestion to make the implementation more concise while preserving the security fix.

gemini-code-assist · 2026-03-12T19:33:56Z

code/experiment.js

+        DOM.syncStatus.textContent = '';
+        const errorSpan = document.createElement('span');
+        errorSpan.style.color = '#ff453a';
+        errorSpan.textContent = `⚠️ Sync Failed. Error: ${error.code || 'Network'}`;
+        DOM.syncStatus.appendChild(errorSpan);


While this correctly fixes the XSS vulnerability, the implementation can be simplified. Instead of clearing the container and appending a new styled span, you can directly set the textContent and style.color of the DOM.syncStatus element. This approach is more concise and achieves the same visual result.

Suggested change

DOM.syncStatus.textContent = '';

const errorSpan = document.createElement('span');

errorSpan.style.color = '#ff453a';

errorSpan.textContent = `⚠️ Sync Failed. Error: ${error.code || 'Network'}`;

DOM.syncStatus.appendChild(errorSpan);

DOM.syncStatus.textContent = `⚠️ Sync Failed. Error: ${error.code || 'Network'}`;

DOM.syncStatus.style.color = '#ff453a';

Copilot

Pull request overview

This PR mitigates a DOM-based XSS vector in the experiment’s sync error UI by ensuring dynamic error details are rendered as plain text rather than HTML.

Changes:

Replaced innerHTML error rendering with DOM node creation + textContent in the sync error handler.
Kept the same user-facing error message while ensuring injected markup can’t execute.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

Copilot · 2026-03-12T19:34:01Z

code/experiment.js

+        DOM.syncStatus.textContent = '';
+        const errorSpan = document.createElement('span');
+        errorSpan.style.color = '#ff453a';
+        errorSpan.textContent = `⚠️ Sync Failed. Error: ${error.code || 'Network'}`;


Using error.code || 'Network' will replace valid falsy codes (e.g., 0 or an empty string) with 'Network'. Prefer nullish coalescing (error.code ?? 'Network') to only fall back when code is null/undefined so the displayed error remains accurate.

Suggested change

errorSpan.textContent = `⚠️ Sync Failed. Error: ${error.code || 'Network'}`;

errorSpan.textContent = `⚠️ Sync Failed. Error: ${error.code ?? 'Network'}`;

hashexplaindata · 2026-03-12T23:37:16Z

Closing: Fixes have already been incorporated directly into the master branch.

google-labs-jules · 2026-03-12T23:37:50Z

Closing: Fixes have already been incorporated directly into the master branch.

Understood. Acknowledging that this work has already been incorporated into the master branch and stopping work on this task.

Copilot AI review requested due to automatic review settings March 12, 2026 19:32

Copilot started reviewing on behalf of hashexplaindata March 12, 2026 19:32 View session

gemini-code-assist bot reviewed Mar 12, 2026

View reviewed changes

Copilot AI reviewed Mar 12, 2026

View reviewed changes

hashexplaindata mentioned this pull request Mar 12, 2026

Unify experiment codebase: fix PID generation, timing accuracy, Firebase sync, and XSS vulnerabilities #20

Merged

Copilot AI mentioned this pull request Mar 12, 2026

[WIP] Merge PR #4 and apply necessary fixes #21

Closed

hashexplaindata closed this Mar 12, 2026

hashexplaindata deleted the security-fix-dom-xss-sync-error-4553460164316150800 branch March 12, 2026 23:50

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

🔒 [security fix] Fix DOM-based XSS in error handling#7

🔒 [security fix] Fix DOM-based XSS in error handling#7
hashexplaindata wants to merge 1 commit intomasterfrom
security-fix-dom-xss-sync-error-4553460164316150800

hashexplaindata commented Mar 12, 2026

Uh oh!

google-labs-jules bot commented Mar 12, 2026

Uh oh!

gemini-code-assist bot commented Mar 12, 2026

Uh oh!

gemini-code-assist bot left a comment

Uh oh!

gemini-code-assist bot Mar 12, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Mar 12, 2026

Uh oh!

hashexplaindata commented Mar 12, 2026

Uh oh!

google-labs-jules bot commented Mar 12, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

	errorSpan.textContent = `⚠️ Sync Failed. Error: ${error.code \|\| 'Network'}`;
	errorSpan.textContent = `⚠️ Sync Failed. Error: ${error.code ?? 'Network'}`;

Conversation

hashexplaindata commented Mar 12, 2026

Uh oh!

google-labs-jules bot commented Mar 12, 2026

Uh oh!

gemini-code-assist bot commented Mar 12, 2026

Summary of Changes

Highlights

Footnotes

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist bot Mar 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Mar 12, 2026

Choose a reason for hiding this comment

Uh oh!

hashexplaindata commented Mar 12, 2026

Uh oh!

google-labs-jules bot commented Mar 12, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants