Merging master to test #587
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation. |
| if (!newSrc.includes("autoplay=1")) { | ||
| newSrc = newSrc.includes("?") ? `${newSrc}&autoplay=1` : `${newSrc}?autoplay=1`; | ||
| } | ||
| mainVideo.setAttribute("src", newSrc); |
Check warning
Code scanning / CodeQL
DOM text reinterpreted as HTML Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI about 2 months ago
To fix the problem, we need to ensure that the newSrc value is properly sanitized before being used as the src attribute of the mainVideo element. One way to achieve this is by using a URL parser to validate and sanitize the URL. This will help prevent any malicious content from being executed.
We will:
- Parse the
newSrcvalue using theURLconstructor to ensure it is a valid URL. - Extract and modify the query parameters as needed.
- Set the sanitized URL as the
srcattribute of themainVideoelement.
| @@ -57,7 +57,11 @@ | ||
| let newSrc = this.getAttribute("data-video-src"); | ||
|
|
||
| if (!newSrc.includes("autoplay=1")) { | ||
| newSrc = newSrc.includes("?") ? `${newSrc}&autoplay=1` : `${newSrc}?autoplay=1`; | ||
| try { | ||
| let url = new URL(newSrc, window.location.origin); | ||
| if (!url.searchParams.has("autoplay")) { | ||
| url.searchParams.append("autoplay", "1"); | ||
| } | ||
| mainVideo.setAttribute("src", url.toString()); | ||
| } catch (e) { | ||
| console.error("Invalid video URL:", newSrc); | ||
| } | ||
| mainVideo.setAttribute("src", newSrc); | ||
| let figcaption = this.parentElement.querySelector("figcaption"); |
Ritm1312357
Qsmo filter fix ogpweb 17415
Ogpweb 17899 grm
Ogpweb 17840
No description provided.