XSS in location plugin

[Xavier59]

community-plugins/packages/location/leaflet/index.js

Line 24 in 30f50e5

var label = urlParam("label");

community-plugins/packages/location/leaflet/index.js

Lines 10 to 20 in 30f50e5

	function showMap(latLng, label)
	{
	var mymap = L.map('mapid').setView(latLng, 13);
	L.tileLayer('https://{s}.tile.openstreetmap.org/{z}/{x}/{y}.png', {
	attribution: '© OpenStreetMap contributors'
	}).addTo(mymap);
	var radius = latLng.accuracy / 2;
	L.marker(latLng).addTo(mymap).bindPopup(label + "\n is within " + radius + " meters from here").openPopup();
	L.circle(latLng, radius).addTo(mymap);

L19 introduce XSS. Html content coming from the label query parameter will be inserted in insecure way.

https://github.com/Leaflet/Leaflet/blob/142f94a9ba5757f7e7180ffa6cbed2b3a9bc73c9/src/layer/Popup.js#L393-L406

Fast forward, this will call _updateContent which will set the div popup innerHTML to content which in our case is going to be label.
https://github.com/Leaflet/Leaflet/blob/142f94a9ba5757f7e7180ffa6cbed2b3a9bc73c9/src/layer/DivOverlay.js#L273-L281

Example label query param: <img%20src=x%20onerror=alert(document.cookie)>