Skip to content

Conversation

@kueken
Copy link
Collaborator

@kueken kueken commented Jul 21, 2025

Potential fix for https://github.com/E2OpenPlugins/e2openplugin-OpenWebif/security/code-scanning/21

To fix the unsafe expansion of self-closing HTML tags, we should avoid using a regex-based approach to modify HTML structure, especially on potentially untrusted input. Instead, we should parse the HTML using a trusted DOM parser and reconstruct it, or use a well-tested sanitization library to handle such transformations. Since we are restricted to edits within the provided code, the safest approach is to modify htmlPrefilter to avoid using the regex to expand self-closing tags. The best solution is to leave the input HTML unchanged, or, if possible, use a DOM approach to parse and serialize HTML fragments safely. However, since we cannot introduce a new complex parser and can only add well-known imports, we should make htmlPrefilter a no-op (return the input unchanged) or, if possible, use a well-known library such as DOMPurify to safely parse and serialize the HTML.

Steps:

  • In sourcefiles/modern/plugins/jquery/jquery-2.2.4.js, replace the body of htmlPrefilter so that it simply returns html (no-op).
  • Optionally, add a comment explaining the change for future maintainers.
  • No additional imports are needed for a no-op.
  • This change avoids expanding self-closing tags and is safe.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

…f-closing HTML tag

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
@kueken kueken marked this pull request as ready for review July 21, 2025 15:58
@kueken kueken merged commit 1bc1bbc into master Jul 21, 2025
6 checks passed
@kueken kueken deleted the alert-autofix-21 branch July 21, 2025 15:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants