Skip to content

fix(live-preview): prevent reflected XSS in browser-not-supported page #2851

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
abose merged 1 commit into from
Apr 26, 2026
+36 −10
Merged

fix(live-preview): prevent reflected XSS in browser-not-supported page #2851

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
42 changes: 34 additions & 8 deletions src/assets/phoenix-splash/live-preview-error.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,14 +5,40 @@
<link rel="stylesheet" href="styles.css">
<meta name="robots" content="noindex">
<script type="text/javascript">
// URL params are reflected into the page, so they must NEVER reach
// innerHTML — that would be reflected XSS. Build the DOM with
// textContent and createElement only. The strings are plain text:
// mainHeading uses "\n" for line breaks, mainSpan uses "{0}" as
// the placeholder for the phcode.io link.
function applyTranslations() {
const urlSearchParams = new URLSearchParams(window.location.search);
const params = Object.fromEntries(urlSearchParams.entries());
if(params.mainHeading){
document.getElementById("mainHeading").innerHTML = decodeURIComponent(params.mainHeading);
const params = Object.fromEntries(
new URLSearchParams(window.location.search).entries()

Check warning on line 15 in src/assets/phoenix-splash/live-preview-error.html

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Prefer `globalThis` over `window`. 


See more on https://sonarcloud.io/project/issues?id=phcode-dev_phoenix&issues=AZ3KbjZUSGa4ah7sJfdh&open=AZ3KbjZUSGa4ah7sJfdh&pullRequest=2851
);
if (params.mainHeading) {
const el = document.getElementById("mainHeading");
el.textContent = "";
const lines = decodeURIComponent(params.mainHeading).split("\n");
lines.forEach(function(line, i) {
if (i > 0) {
el.appendChild(document.createElement("br"));
}
el.appendChild(document.createTextNode(line));
});
}
if(params.mainSpan){
document.getElementById("mainSpan").innerHTML = decodeURIComponent(params.mainSpan);
if (params.mainSpan) {
const el = document.getElementById("mainSpan");
el.textContent = "";
const parts = decodeURIComponent(params.mainSpan).split("{0}");
parts.forEach(function(part, i) {
if (i > 0) {
const a = document.createElement("a");
a.href = "https://phcode.io";
a.style.color = "white";
a.textContent = "phcode.io";
el.appendChild(a);
}
el.appendChild(document.createTextNode(part));
});
}
}
</script>
Expand All @@ -23,9 +49,9 @@
<div id="mainDiv">
<img id="logo" src="images/phoenix-logo-broken.svg"/>
<div id="MainText" class="safari-text">
<h2 id="mainHeading">Uh Oh! <br>Your current browser doesn't support live preview.</h2>
<h2 id="mainHeading">Uh Oh!<br>Your current browser doesn't support live preview.</h2>
<span id="mainSpan">
Get the best live preview experience by downloading our native apps for Windows, Mac, and Linux from <a href="https://phcode.io" style="color: white">phcode.io</a>.<br>
Get the best live preview experience by downloading our native apps for Windows, Mac, and Linux from <a href="https://phcode.io" style="color: white">phcode.io</a>.
</span><br>
</div>
</div>
Expand Down
4 changes: 2 additions & 2 deletions src/nls/root/strings.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1503,8 +1503,8 @@ define({
"DESCRIPTION_LIVEDEV_NO_PREVIEW_DETAILS": "Please select an HTML file to preview",
"DESCRIPTION_LIVEDEV_PREVIEW_RESTRICTED": "Preview Unavailable!",
"DESCRIPTION_LIVEDEV_PREVIEW_RESTRICTED_DETAILS": "This HTML file is not part of the current project. For security reasons, only project files can be live-previewed. To preview this file, open its containing folder as a separate project.",
"DESCRIPTION_LIVEDEV_MAIN_HEADING": "Uh Oh! <br>Your current browser doesn't support live preview.",
"DESCRIPTION_LIVEDEV_MAIN_SPAN": "Get the best live preview experience by downloading our native apps for Windows, Mac, and Linux from <a href=\"https://phcode.io\" style=\"color: white\">phcode.io</a>.<br>",
"DESCRIPTION_LIVEDEV_MAIN_HEADING": "Uh Oh!\nYour current browser doesn't support live preview.",
"DESCRIPTION_LIVEDEV_MAIN_SPAN": "Get the best live preview experience by downloading our native apps for Windows, Mac, and Linux from {0}.",
"DESCRIPTION_LIVEDEV_SECURITY_POPOUT_MESSAGE": "You are about to open a file for live preview. Please proceed only if you trust the source of this project. Click 'Trust Project' to continue, or close this window if you do not trust the source.",
"DESCRIPTION_LIVEDEV_SECURITY_TRUST_MESSAGE": "You are about to open a file for live preview. Please proceed by clicking 'Trust Project' only if you trust the source of this project!",
"CONFIRM_EXTERNAL_BROWSER_TITLE": "Pop-ups Blocked",
Expand Down
Loading