From a9c110a0a2669fdfd08a92fe6a721d9e2568d6cb Mon Sep 17 00:00:00 2001 From: tomaioo Date: Tue, 23 Jun 2026 17:12:52 -0700 Subject: [PATCH] fix(lib): unescaped user input in css selector (getidfromurl In assetsUtils.js, the `getIdFromUrl` function constructs a CSS selector using user-provided URL input with only single-quote escaping. This is vulnerable to CSS injection attacks. An attacker could craft a URL containing CSS metacharacters to break out of the attribute selector context, potentially leading to DOM-based XSS or information disclosure via CSS selectors. Signed-off-by: tomaioo <203048277+tomaioo@users.noreply.github.com> --- src/lib/assetsUtils.js | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/src/lib/assetsUtils.js b/src/lib/assetsUtils.js index 03877507b..bb416c2d5 100644 --- a/src/lib/assetsUtils.js +++ b/src/lib/assetsUtils.js @@ -7,8 +7,13 @@ export function getUrlFromId(assetId) { } export function getIdFromUrl(url) { - const escaped = url.replace(/'/g, "\\'"); - return document.querySelector(`a-assets > [src='${escaped}']`)?.id; + const assets = document.querySelectorAll('a-assets > *'); + for (const asset of assets) { + if (asset.getAttribute('src') === url) { + return asset.id; + } + } + return undefined; } export function getFilename(url, converted = false) {