wpallstars/wp-plugin-starter-template-for-ai-coding
Template
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: validate type parameter against allow-list in showMessage (#83)

Browse Source 
Adds allow-list validation for the 'type' parameter in showMessage()
to prevent class injection vulnerabilities. The type is now checked
against ['success', 'error'] before being passed to addClass(), with
a safe fallback to 'error' for any unexpected values.

Addresses review feedback from PR #47 (gemini-code-assist finding).
Closes #76
This commit is contained in:
Marcus Quinn
2026-03-17 19:33:04 +00:00
committed by GitHub
parent 6300f1c545
commit e1ee99ac9c
1 changed files with 8 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
admin/js/update-source-selector.js
View File

@@ -153,11 +153,15 @@
showMessage: function (type, message) { showMessage: function (type, message) {
const $message = this.$modal.find( '.wpst-modal-message' ); const $message = this.$modal.find( '.wpst-modal-message' );
// Set message as plain text to prevent XSS, then apply type class. // Validate type against allow-list to prevent class injection vulnerabilities.
$message.text( message ).removeClass( 'success error' ).addClass( type ).show(); const allowedTypes = [ 'success', 'error' ];
const safeType = allowedTypes.includes( type ) ? type : 'error';
// Set message as plain text to prevent XSS, then apply validated type class.
$message.text( message ).removeClass( 'success error' ).addClass( safeType ).show();
// Hide message after a delay for success messages. // Hide message after a delay for success messages.
if (type === 'success') { if (safeType === 'success') {
setTimeout( setTimeout(
function () { function () {
$message.fadeOut( 300 ); $message.fadeOut( 300 );