Potential XSS issue in the stylesheets

[Andreas-Hjortland]

First of all I must thank you for learning me an awesome trick that I didn't know about =)

I noticed that you are inserting the style tag as raw HTML with potentially unescaped parameters. Granted it is not likely this will be exploitable since the web page will need to allow users to set the class name, or any of the drop shadow parameters for this to be exploitable, but it is also relatively simple to fix it.

The fix is replacing

document.head.insertAdjacentHTML('beforeend', `<style>
styles here...
</style>`);

with

const styles = document.createElement('style');
styles.textContent = `
styles here...
`;
document.head.appendChild(styles);

I have attached a JSfiddle here which shows how you can exploit it... Just hit the submit button and you will get an alert.

[robinloeffel]

Love it, fixed in 62a8108!

Thank you for taking the time and looking through the source!