🛡️ Sentinel: Fix JavaScript Injection in DomMixin#38
🛡️ Sentinel: Fix JavaScript Injection in DomMixin#38ToufiqQureshi wants to merge 1 commit intomainfrom
Conversation
This commit mitigates a JavaScript injection vulnerability in `DomMixin` where CSS selectors were unsafely interpolated into JS templates. We now use `json.dumps()` to ensure selectors are treated as safe string literals in the browser context. - Updated `query_selector` and `query_selector_all` to use `json.dumps(selector)`. - Added regression tests in `tests/test_security_fixes.py`. Co-authored-by: ToufiqQureshi <139612256+ToufiqQureshi@users.noreply.github.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
1 participant
I have identified and fixed a high-priority JavaScript injection vulnerability in the
DomMixinclass.🛡️ Sentinel Security Report
🚨 Severity: HIGH
💡 Vulnerability: JavaScript Injection via CSS Selectors
🎯 Impact: An attacker or malicious input could provide a specially crafted CSS selector (containing backticks or semicolons) to execute arbitrary JavaScript within the browser context via CDP
Runtime.evaluate.🔧 Fix: Implemented safe string interpolation using
json.dumps(selector)inchuscraper/core/tabs/dom.py. This ensures the selector is always correctly escaped and quoted as a JavaScript string literal.✅ Verification: Added a new test suite
tests/test_security_fixes.pywhich uses mocks to verify that malicious selectors are properly escaped in the outgoing CDP commands.Maine
dom.pymein ek critical injection gap fix kiya hai. Ab user-provided selectors properly escape hote hain, jisse browser mein arbitrary code execution ka risk khatam ho gaya hai.PR created automatically by Jules for task 5747331146162427513 started by @ToufiqQureshi