Repository navigation
fix(ui): patch XSS + add TypeScript frontend to source control - #5
Merged
Merged
Conversation
The priv/static TypeScript frontend was never committed — it lived only in dev working trees, so the running play.asobi.dev image was built from unversioned code. Adding it now. Alongside, fix an XSS hazard in ui.ts: three innerHTML template literals rendered server-controlled strings (boon name/description, vote option labels, results table rows with player ids) directly into the DOM. Any stored script in those fields would execute for every viewer. Replaced with createElement + textContent / replaceChildren so server strings are never parsed as HTML. .gitignore now excludes priv/static/node_modules and priv/static/dist (the latter is rebuilt from src via npm run build, no need to track).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Two things in one PR because you can't land one without the other:
Add
priv/static/to the repo. The TypeScript frontend has never been committed —git log --all -- priv/was empty. The Dockerfile does `COPY priv ./priv`, so deploys build from whatever is in the local working tree. That's now fixed: sources, assets, package.json, tsconfig, index.html are tracked. `node_modules/` and `dist/` are gitignored (dist is rebuilt from src).XSS hardening in `ui.ts`. Three `innerHTML` template literals rendered server-controlled strings (boon name/description, vote option labels, results table cells with player ids) straight into the DOM. Any stored script in those fields would execute for every viewer. Swapped for `createElement` + `textContent` / `replaceChildren` so server strings are never parsed as HTML.
Audit item S8 from the April-3 arena security review.
Test plan