Summary
getProjectHTML() in web-app/js/projects.js:94 interpolates the projectName parameter directly into an HTML template string without escaping, creating a DOM-based XSS vector. An escapeHtml helper already exists in the codebase (web-app/js/modules/utils.js:28) and is exported, but is never used here.
Location
web-app/js/projects.js — line 94 (within getProjectHTML function, lines 86–101)
Vulnerable Code
<p style="color: var(--text-secondary, #a0aec0); margin-bottom: 1.5rem;">
We couldn't initialize the interactive environment for <strong>${projectName}</strong>.
</p>Attack Surface
- Direct function call:
openProjectSafe is exposed as window.openProjectSafe in web-app/js/main.js:1663, so any browser extension, third-party script, or console invocation can trigger it with arbitrary values.
- URL parameter: While the
?project= path has a partial guard (it checks against known data-project attributes), this is protection by coincidence, not design.
- Indirect injection: Any future code path that feeds user-controlled strings to
openProjectSafe — such as search suggestions, deep-links, or bookmark handlers — will hit this sink.
Payload Example
A payload like <img src=x onerror=alert(document.cookie)> would execute arbitrary JavaScript if it reaches this template.
Fix
Use escapeHtml() (available from web-app/js/modules/utils.js) before interpolation:
<strong>${escapeHtml(projectName)}</strong>Why This Matters
This is a direct XSS sink in a security-reviewed Python mini-projects repository. The utility function to prevent this already exists but is unused here — making this both a vulnerability and a code quality issue.
Summary
getProjectHTML()inweb-app/js/projects.js:94interpolates theprojectNameparameter directly into an HTML template string without escaping, creating a DOM-based XSS vector. AnescapeHtmlhelper already exists in the codebase (web-app/js/modules/utils.js:28) and is exported, but is never used here.Location
web-app/js/projects.js— line 94 (withingetProjectHTMLfunction, lines 86–101)Vulnerable Code
Attack Surface
openProjectSafeis exposed aswindow.openProjectSafeinweb-app/js/main.js:1663, so any browser extension, third-party script, or console invocation can trigger it with arbitrary values.?project=path has a partial guard (it checks against knowndata-projectattributes), this is protection by coincidence, not design.openProjectSafe— such as search suggestions, deep-links, or bookmark handlers — will hit this sink.Payload Example
A payload like
<img src=x onerror=alert(document.cookie)>would execute arbitrary JavaScript if it reaches this template.Fix
Use
escapeHtml()(available fromweb-app/js/modules/utils.js) before interpolation:Why This Matters
This is a direct XSS sink in a security-reviewed Python mini-projects repository. The utility function to prevent this already exists but is unused here — making this both a vulnerability and a code quality issue.