Merge pull request #1253 from GSA/alert-autofix-42

Fix code scanning alert no. 42: Client-side cross-site scripting
GSA · Dec 16, 2024 · c64a9f4 · c64a9f4
2 parents 480735a + 1f1b6f3
commit c64a9f4
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 4 deletions.
diff --git a/assets/js/search.js b/assets/js/search.js
@@ -1,3 +1,5 @@
+import DOMPurify from 'dompurify';
+
 document.addEventListener("DOMContentLoaded", function () {
     var searchResults = document.getElementById("search-results");
     var pathParts = window.location.pathname.split("/payment-accuracy/");
@@ -44,9 +46,9 @@ document.addEventListener("DOMContentLoaded", function () {
             .then(function (posts) {
                 totalResults = posts.web.total;
                 document.getElementById("search-params").innerHTML =
-                    urlParams.get("query");
+                    DOMPurify.sanitize(urlParams.get("query"));
                 document.getElementById("search-keyword").innerHTML =
-                    urlParams.get("query");
+                    DOMPurify.sanitize(urlParams.get("query"));
                 document.getElementById("results-count").innerHTML = totalResults;
 
                 if (posts.web.results.length > 0) {

diff --git a/package.json b/package.json
@@ -12,7 +12,8 @@
     "csv-writer": "^1.6.0",
     "jquery": "3.6.4",
     "react-redux": "^7.2.9",
-    "striptags": "^3.2.0"
+    "striptags": "^3.2.0",
+    "dompurify": "^3.2.3"
   },
   "devDependencies": {
     "a11y": "^0.5.1",
@@ -22,7 +23,7 @@
   },
   "overrides": {
     "cross-spawn": "^6.0.6",
-    "trim":">=0.0.3",
+    "trim": ">=0.0.3",
     "tough-cookie": ">=4.1.4",
     "got": ">=11.8.5",
     "trim-newlines": ">=5.0.0"