fix(core): replace innerHTML with textContent in password directive#367
fix(core): replace innerHTML with textContent in password directive#367Kaushik-Kumar-CEG wants to merge 1 commit into
Conversation
Using innerHTML to set plain text strings is an unnecessary XSS vector. Replace with textContent which is safer and functionally equivalent for non-HTML content.
|
Warning Review limit reached
Your plan currently allows 1 review/hour. Refill in 9 minutes and 30 seconds. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more review capacity refills, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than trial, open-source, and free plans. In all cases, review capacity refills continuously over time. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
|
Hi @snehar-nd @drtechie — this replaces |
1 participant
📋 Description
myPassword.directive.tsusesinnerHTMLto display plain text feedback ("Strong Password", "Weak Password", etc.). Since these are non-HTML strings,innerHTMLis unnecessary and introduces an XSS vector. Replaced withtextContentwhich is safer and functionally identical for plain text.✅ Type of Change
ℹ️ Additional Information
textContentdoes not invoke the HTML parser, making it marginally fastertextContentis immune to XSS by design — it treats all input as text, never as markup