fix: DOM text reinterpreted as HTML leading to self-XSS (#633)

* fix: DOM text reinterpreted as HTML Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * fix: format with prettier --------- Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Co-authored-by: Oliver Eyton-Williams <[email protected]>
freeCodeCamp · Jan 3, 2025 · 29ac0f2 · 29ac0f2
1 parent cfb2b36
commit 29ac0f2
Showing 1 changed file with 7 additions and 3 deletions.
diff --git a/apps/image-search-abstraction-layer/public/imageSearch.js b/apps/image-search-abstraction-layer/public/imageSearch.js
@@ -37,16 +37,20 @@ function updateURL() {
   var queryTest = /\S/;
 
   if (selected == 'query' && queryTest.test(queryValue)) {
-    url += 'query/' + queryValue + '?page=' + pageValue;
+    url +=
+      'query/' +
+      encodeURIComponent(queryValue) +
+      '?page=' +
+      encodeURIComponent(pageValue);
     if (sizeValue != 'All') {
-      url += '&size=' + sizeValue;
+      url += '&size=' + encodeURIComponent(sizeValue);
     }
   }
   if (selected == 'recent') {
     url += 'recent/';
   }
 
-  urlDiv.innerHTML = url;
+  urlDiv.textContent = url;
   urlDiv.setAttribute('href', url);
 }