Security: Potential XSS in HTML rendering bridge (unsanitized attributes/URLs)

[tomaioo]

Summary

Security: Potential XSS in HTML rendering bridge (unsanitized attributes/URLs)

Problem

Severity: High | File: src/static/app-plus/mp-html/js/handler.js:L1

The mp-html bridge renderer builds DOM nodes from provided content and applies attributes directly via setAttribute without a visible allowlist/sanitization step. If untrusted HTML/content reaches window.setContent(...), attacker-controlled attributes such as dangerous href/src values (e.g., javascript: / data: payloads depending on runtime behavior) or other injected markup could execute script in the embedded webview context.

Solution

Add strict sanitization before DOM construction: use an allowlist of tags and attributes, explicitly strip event-handler attributes (on*), and validate URL-bearing attributes (src, href, xlink:href) to only permit safe schemes (e.g., https:). Consider using a vetted sanitizer (DOMPurify-equivalent for the target runtime) before calling setContent.

Changes

• src/static/app-plus/mp-html/js/handler.js (modified)
• src/static/app-plus/up-canvas/local.html (modified)

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}