DOM Text Reinterpreted as HTML - Potential XSS Vulnerability in core/scripts/crispr_scripts.js

[AlexJSully]

Description:

There is a potential Cross-Site Scripting (XSS) vulnerability in the core/scripts/crispr_scripts.js file, specifically around line 785. The script is appending text to the DOM via append_str, which is reinterpreted as HTML without escaping meta-characters. This issue has been flagged multiple times in the CodeQL analysis for the SciGrade repository.

Affected Lines:

js
Copy code
core/scripts/crispr_scripts.js:785
append_str += "";
append_str += "";
append_str += "";
$("#mainContainer").append(append_str);

Risk:

By appending raw HTML strings directly to the DOM, without escaping meta-characters, this code is vulnerable to Cross-Site Scripting (XSS) attacks, which could allow malicious users to inject arbitrary HTML or JavaScript into the web page.

Remediation Steps:

Escape the meta-characters before appending the string to the DOM. Consider using functions that ensure HTML-encoded characters, such as:

Using jQuery's .text() to safely append strings.

Use a library like DOMPurify to sanitize the appended string.

Example Fix:

js
Copy code
$("#mainContainer").append($("

").text(append_str));

Ensure the proper escaping of any dynamic content within append_str that may be interpreted as HTML.

Review all instances where append_str is appended to the DOM and ensure no user input or dynamic content is being directly injected as raw HTML.

After making changes, rerun the CodeQL analysis to confirm that the vulnerability has been fixed.

CodeQL Vulnerability Details:

Rule ID: js/xss-through-dom

Query: View source

This issue was flagged in multiple places (CodeQL scan results 43-39). Please review and resolve all instances in the affected file.