Possible to bypass XSS filter with nodeNS about virtual-dom HOT 3 CLOSED

The crux of it seems to be that nodeNS arguments are swapped between Elm and JS, on the elm side the tag is the first argument passed into nodeNS

This is close, but not quite what the issue is.

Compare nodeNS:

nodeNS : String -> String -> List (Attribute msg) -> List (Node msg) -> Node msg
nodeNS tag =
  Elm.Kernel.VirtualDom.nodeNS (Elm.Kernel.VirtualDom.noScript tag)

…with keyedNodeNS:

keyedNodeNS : String -> String -> List (Attribute msg) -> List ( String, Node msg ) -> Node msg
keyedNodeNS namespace tag =
  Elm.Kernel.VirtualDom.keyedNodeNS namespace (Elm.Kernel.VirtualDom.noScript tag)

nodeNS first parameter is named wrong, and noScript is uselessly called on it. Here’s my suggestion:

nodeNS : String -> String -> List (Attribute msg) -> List (Node msg) -> Node msg
nodeNS namespace tag =
  Elm.Kernel.VirtualDom.nodeNS namespace (Elm.Kernel.VirtualDom.noScript tag)

from virtual-dom.

Seems there is just just a little mistake made by @evancz.

from virtual-dom.

Fixed in 9a389f8 which should be published shortly with version 1.0.3. Thank you for the report, and thank you to @jfmengels for organizing the XSS issues and coordinating on testing.

from virtual-dom.