From af0d3b2f1f1942ed345674fca948ba62df3efa6a Mon Sep 17 00:00:00 2001 From: Salah Alkhwlani Date: Tue, 15 Sep 2026 11:21:28 +0000 Subject: [PATCH] fix(themes): prevent DOM XSS via innerHTML on search page title intent(theme-raed): SAL-1340 - Intigriti SALLA-38ORF9DB reported that the raw q search parameter is reflected into #page-main-title via innerHTML on the salla-products-list::products.fetched event, allowing HTML/JS injection. Switch to textContent since the title is always plain text. --- src/assets/js/products.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/assets/js/products.js b/src/assets/js/products.js index 9db5dc764..ebe29fc02 100644 --- a/src/assets/js/products.js +++ b/src/assets/js/products.js @@ -21,7 +21,7 @@ class Products extends BasePage { }); salla.event.on('salla-products-list::products.fetched', res=>{ - res.title && (app.element('#page-main-title').innerHTML = res.title); + res.title && (app.element('#page-main-title').textContent = res.title); });