From ebaf83f1b5330f9d7498627b7d39ca6149080772 Mon Sep 17 00:00:00 2001
From: Raunak Raj <71929976+bajrangCoder@users.noreply.github.com>
Date: Fri, 27 Feb 2026 22:04:59 +0530
Subject: [PATCH 1/5] fix: XSS and potential html injection things
---
src/lib/notificationManager.js | 71 ++++++++++++++++++++++----------
src/pages/changelog/changelog.js | 4 +-
2 files changed, 53 insertions(+), 22 deletions(-)
diff --git a/src/lib/notificationManager.js b/src/lib/notificationManager.js
index 52518402d..2ff308981 100644
--- a/src/lib/notificationManager.js
+++ b/src/lib/notificationManager.js
@@ -1,4 +1,5 @@
import sidebarApps from "sidebarApps";
+import DOMPurify from "dompurify";
// Singleton instance
let instance = null;
@@ -107,21 +108,24 @@ export default class NotificationManager {
data-id={notification.id}
>
);
+ const safeIcon = this.sanitizeIcon(this.parseIcon(notification.icon));
+ const safeTitle = this.sanitizeText(notification.title);
+ const safeMessage = this.sanitizeText(notification.message);
element.innerHTML = `
-
-
- ${notification.title}
-
${this.formatTime(notification.time)}
+
+ ${safeIcon}
-
${notification.message}
-
-
Dismiss
+
+
+ ${safeTitle}
+ ${this.formatTime(notification.time)}
+
+
${safeMessage}
+
-
- `;
+ `;
if (notification.action) {
element.addEventListener("click", (e) => {
if (e.target.closest(".action-button")) {
@@ -140,16 +144,27 @@ export default class NotificationManager {
data-id={notification.id}
>
);
+ const safeIcon = this.sanitizeIcon(this.parseIcon(notification.icon));
+ const safeTitle = this.sanitizeText(notification.title);
+ const safeMessage = this.sanitizeText(notification.message);
element.innerHTML = `
-
${this.parseIcon(notification.icon)}
-
-
- ${notification.title}
+
${safeIcon}
+
+
+ ${safeTitle}
+
+
${safeMessage}
-
${notification.message}
-
- ${notification.autoClose ? "" : `
`}
- `;
+ ${notification.autoClose ? "" : `
`}
+ `;
+
+ const closeIcon = element.querySelector(".close-icon");
+ if (closeIcon) {
+ closeIcon.addEventListener("click", (event) => {
+ event.stopPropagation();
+ element.remove();
+ });
+ }
if (notification.action) {
element.addEventListener("click", () =>
notification.action(notification),
@@ -202,13 +217,27 @@ export default class NotificationManager {
}
parseIcon(icon) {
- if (!icon) return this.DEFAULT_ICON;
+ if (typeof icon !== "string" || !icon) return this.DEFAULT_ICON;
if (icon.startsWith("