akadmin/chatwoot
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

fix: use safe DOM manipulation for article heading permalinks

Browse Source 
Fixes [CW-6300](https://linear.app/chatwoot/issue/CW-6300/advisory-stored-dom-xss-in-chatwoot-help-center-article-heading)
This commit is contained in:
Vinay Keerthi
2026-01-12 16:18:35 +05:30
parent b099d3a1eb
commit 6e60e3b946
1 changed files with 11 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/javascript/portal/portalHelpers.js
+11 -2
View File
@@ -14,10 +14,19 @@ export const getHeadingsfromTheArticle = () => {
const rows = [];
const articleElement = document.getElementById('cw-article-content');
articleElement.querySelectorAll('h1, h2, h3').forEach(element => {
const slug = slugifyWithCounter(element.innerText);
const headingText = element.innerText;
const slug = slugifyWithCounter(headingText);
element.id = slug;
element.className = 'scroll-mt-24 heading';
element.innerHTML += `<a class="permalink text-slate-600 ml-3" href="#${slug}" title="${element.innerText}" data-turbolinks="false">#</a>`;
const permalink = document.createElement('a');
permalink.className = 'permalink text-slate-600 ml-3';
permalink.href = `#${slug}`;
permalink.title = headingText;
permalink.dataset.turbolinks = 'false';
permalink.textContent = '#';
element.appendChild(permalink);
rows.push({
slug,
title: element.innerText,