Securing wins.js from XSS vulnerability due to innerHTML

[freaky4wrld]

Overview

As developers we aim to protect JavaScript files from XSS vulnerabilities, preventing malicious script injections that can compromise user security.

Action Items

• Open the file assets/js/wins.js in your IDE
• Search the instances of innerHTML in the file.
• Replace the instances of the innerHTML property with textContent , using the createElement method for creating DOM elements where necessary
• Use Docker to test the Wins page at mobile, table, and desktop screen sizes

Resources/Instructions

• https://developer.mozilla.org/en-US/docs/Web/API/Document/createElement
• https://developer.mozilla.org/en-US/docs/Web/API/Node/textContent
• https://medium.com/front-end-weekly/javascript-innerhtml-innertext-and-textcontent-b75ec895cbe3
• https://github.com/hackforla/website/blob/gh-pages/assets/js/wins.js
• https://www.hackforla.org/wins
• This issue resulted from ER: Potential XSS Vulnerability in wins.js #5654

[github-actions]

Hi @danvgar, thank you for taking up this issue! Hfla appreciates you :)

Do let fellow developers know about your:-
i. Availability: (When are you available to work on the issue/answer questions other programmers might have about your issue?)
ii. ETA: (When do you expect this issue to be completed?)

You're awesome!

P.S. - You may not take up another issue until this issue gets merged (or closed). Thanks again :)

[danvgar]

Happy to take on this issue. Just assigned it to myself and will provide an update by EOW.

[ExperimentsInHonesty]

@danvgar I am moving this issue to the in progress column, since you are working on it. On future issues please move the issue after you self assign.

[danvgar]

@danvgar I am moving this issue to the in progress column, since you are working on it. On future issues please move the issue after you self assign.

Ah sorry, thank you for catching that, @ExperimentsInHonesty !

[github-actions]

@danvgar

Please add update using the below template (even if you have a pull request). Afterwards, remove the 'To Update !' label and add the 'Status: Updated' label.

1. Progress: "What is the current status of your project? What have you completed and what is left to do?"
2. Blockers: "Difficulties or errors encountered."
3. Availability: "How much time will you have this week to work on this issue?"
4. ETA: "When do you expect this issue to be completed?"
5. Pictures (optional): "Add any pictures of the visual changes made to the site so far."

If you need help, be sure to either: 1) place your issue in the Questions/In Review column of the Project Board and ask for help at your next meeting, 2) put a "Status: Help Wanted" label on your issue and pull request, or 3) put up a request for assistance on the #hfla-site channel. Please note that including your questions in the issue comments- along with screenshots, if applicable- will help us to help you. Here and here are examples of well-formed questions.

_{You are receiving this comment because your last comment was before Monday, March 4, 2024 at 11:06 PM PST.}

[danvgar]

Apologies, I've been sick on-and-off the past week and have not been able to sit with this. I expect it to be completed by EOW Sun Mar 17, if not sooner!