fix(security): escape alertDiv + openTradeModal in otc-bridge templates - #16833
Closed
xxzzzzy wants to merge 4 commits into
Closed
fix(security): escape alertDiv + openTradeModal in otc-bridge templates#16833xxzzzzy wants to merge 4 commits into
xxzzzzy wants to merge 4 commits into
Conversation
… innerHTML The /api/miners and /wallet/balance responses are dropped into innerHTML in the miner and balance tables. Any field that contains HTML becomes a stored XSS sink. Wrap every API-controlled interpolation (and the two error banners) in esc() and add the helper.
The /health, /epoch, /api/miners, and /api/transactions responses are dropped into innerHTML in the miner chart / table and the transactions list. Any field that contains HTML becomes a stored XSS sink. Wrap every API-controlled interpolation in esc() and add the helper.
The /api/orders and /api/trade/history responses are dropped into innerHTML in the order cards and trade history table. Any field that contains HTML becomes a stored XSS sink. The openTradeModal(orderId) onclick attribute also receives unescaped data, allowing attribute breakout. Wrap every API-controlled interpolation in esc() and add the helper.
otc-bridge/templates/index.html:
- Wrap `result.error` and `result.order.id` (when present) in `esc()`
before injecting into `alertDiv.innerHTML`. The error / success
banners appear immediately after form submission; a compromised
bridge endpoint can store arbitrary HTML in those fields and have
it execute on every page visit.
- Extend `openTradeModal(orderId)` to `openTradeModal(orderId, orderType)`
so the order type is passed explicitly instead of reading an
undefined `order.` closure variable. The `<li>Deposit ${order.order_type === ...}`
branch is gone; the literal now comes from a local `depositInstr`
derived from `esc(orderType)`.
- Update the per-card button `onclick="openTradeModal('${esc(order.id)}')"`
to pass `esc(order.order_type)` as the second argument. The order_type
string is now escaped on the way in AND on the way into the modal.
tests/test_otc_bridge_alert_modal_xss.py:
- 7 source-pattern regression tests, all pass.
Companion to Scottcjn#16818 (same defensive posture). Closes the residual XSS
sink in the same file that PR Scottcjn#16818 missed.
github-actions
Bot
added
the
needs-tier
Scottcjn
approved these changes
Sep 5, 2026
Scottcjn
left a comment
Scottcjn
left a comment
Owner
There was a problem hiding this comment.
Escapes alertDiv and openTradeModal inputs in otc-bridge templates.
Owner
|
Merging your stack bottom-first: #16832 landed on |
Scottcjn
added a commit
that referenced
this pull request
Sep 5, 2026
…16828 #16829 #16833) (#16861) * fix(security): escape API-controlled values in elyanlabs-upstream-contributions innerHTML (#16826) * fix(security): use HTTPS by default in beacon_client.py (#16827) * fix(security): default JS SDK TLS verification to on (#16828) * fix(security): escape API-controlled values in vscode-rustchain webview innerHTML (#16829) * fix(security): escape alertDiv + openTradeModal in otc-bridge templates (#16833) --------- Co-authored-by: xxzzzzy <xxzzzzy@users.noreply.github.com>
Owner
|
Landed via #16861 — this rung's own file(s) carried onto main by a maintainer with your authorship preserved (the lower rungs were already merged, so rebasing here was mechanical). Credit stays with you. Closing the original. — Sophia |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
otc-bridge/templates/index.htmlhad three residual XSS sinks that the same-file patch in #16818 did not touch:alertDiv.innerHTML =<div ...alert-error>${result.error};`alertDiv.innerHTML =<div ...alert-success>...${result.order.id};`<button onclick="openTradeModal(''${esc(order.id)}'')">whose target reads the bare identifierorder.order_typeinside the modal (undefined when called by attribute handler).All three are reachable from
/api/ordersand/api/ordersPOST responses. A compromised or misconfigured bridge can store arbitrary HTML / attribute-breakout payloads inresult.error,result.order.id,order.order_type, and have them execute on every visit.Fix
Wrap
result.errorandresult.order && result.order.idinesc()when injecting intoalertDiv.innerHTML.Extend
openTradeModal(orderId)toopenTradeModal(orderId, orderType)and derive the deposit literal fromesc(orderType)instead of the bareorder.order_type.Update the per-card button to pass
esc(order.order_type)as the second argument. The order type is now escaped on the way in AND on the way into the modal.Tests
tests/test_otc_bridge_alert_modal_xss.py— 7 source-pattern regression tests, all pass:Related
Companion to fix(security): escape API-controlled values in otc-bridge templates #16818 (same defensive posture). Closes the residual XSS sink in the same file that PR fix(security): escape API-controlled values in otc-bridge templates #16818 missed.
Same defensive posture as fix(security): escape API-controlled values in sophia_dashboard innerHTML (RIP-306) #16832, fix(security): prevent stored XSS via certId in bcos-badge-generator #16809–fix(security): escape API-controlled values in jonasxzb net-status page #16821, fix(security): sandbox webview JS and validate openExternal URL (F-01, F-02) #16790.
Notes
Non-breaking hardening: the visible output is identical when the API returns well-formed values.
esc()helper was already present from fix(security): escape API-controlled values in otc-bridge templates #16818; no new helpers added.No new dependencies, no API change.