wip #487
wip #487
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| function setAIButtonLoadingState(submitButton, isLoading) { | ||
| if (!isLoading) { | ||
| submitButton.disabled = false; | ||
| submitButton.innerHTML = submitButton.getAttribute('data-original-content') || 'Ingest'; |
Check warning
Code scanning / CodeQL
DOM text reinterpreted as HTML Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 4 months ago
To fix the problem, we need to ensure that any text assigned to submitButton.innerHTML is properly escaped so that it cannot be interpreted as HTML. The best way to do this is to use textContent instead of innerHTML when restoring the button's original content, as textContent will treat the value as plain text and not parse it as HTML. However, since the loading state uses HTML (a spinner SVG and markup), we need to use innerHTML only for the loading state, and use textContent for restoring the original button label.
Specifically, in the setAIButtonLoadingState function:
- When restoring the button to its original state (
isLoading === false), setsubmitButton.textContentto the value ofdata-original-content(or 'Ingest'). - When entering the loading state, continue to use
innerHTMLfor the spinner markup.
This change should be made in the region around line 102 in src/static/js/utils_ai.js.
| @@ -101,3 +101,3 @@ | ||
| submitButton.disabled = false; | ||
| submitButton.innerHTML = submitButton.getAttribute('data-original-content') || 'Ingest'; | ||
| submitButton.textContent = submitButton.getAttribute('data-original-content') || 'Ingest'; | ||
| submitButton.classList.remove('bg-[#ffb14d]', 'opacity-75', 'cursor-not-allowed'); |
|
This pull request has merge conflicts that must be resolved before it can be merged. |
|
This pull request has resolved merge conflicts and is ready for review. |
|
This pull request has merge conflicts that must be resolved before it can be merged. |
|
Hi there! We haven’t seen activity on this pull request for 45 days, so I’m marking it as stale. |
|
Hi there! We haven’t heard anything for 10 days, so I’m closing this pull request. Feel free to reopen if you’d like to continue working on it. Thanks! |
No description provided.