Security: Stored XSS via Unsanitized onclick Attribute Injection in Sidebar

[rishab11250]

Summary

Script names and relative_path values are interpolated directly into onclick handler strings in renderSidebar() without any escaping. A maliciously-named script file breaks out of the JS string and executes arbitrary code.

Location

ui/app.js — renderSidebar(), renderWelcomeStats()

Vulnerable patterns:
onclick="selectScript('${s.relative_path}')"
onclick="toggleCategory('${cat}')"
onclick="toggleFavorite('${s.relative_path}')"

Steps to Reproduce

1. Create a script file named: test'; alert(1); '.sh
2. Refresh the app
3. Script appears in sidebar
4. Sidebar renders: onclick="selectScript('test'; alert(1); '.sh')"
5. alert() executes

Risk

Stored XSS. Attacker needs write access to scripts/ directory or can social engineer via GitHub import.

Proposed Fix

Replace onclick string handlers with addEventListener via dataset attributes or pass all interpolated values through escapeAttr().

[rishab11250]

Hey @siddu-k, please assign me these issues so that I can work on them.

[kunal-9090]

Hi @siddu-k, I'd like to work on this under GSSoC'26. I can replace the vulnerable inline onclick handlers in the sidebar with safe data attributes and delegated event listeners while preserving category toggles, script selection, keyboard activation, and favorites. Could you please assign this to me?

[kunal-9090]

Hi @siddu-k, I have prepared a focused fix for this GSSoC-approved advanced security issue.\n\nPlan implemented:\n- Remove inline sidebar onclick/onkeydown handlers that interpolate script/category data.\n- Replace them with escaped data-* attributes.\n- Add delegated click/keyboard listeners for category, root, script selection, and favorite toggling.\n- Verify ui/app.js parses with node --check.\n\nCould you please assign this issue to me if available?

[sanudking]

Hey! This looks like a great issue to work on. I'm a first-year CSE student at NIT Jalandhar participating in GSSoC 2026. I have knowledge in Javascript and would like to take this up. Can I get assigned? I'll submit a PR within a day or two. 🙏