GHSA-3qxh-p7jc-5xh6
Solid Lacks Escaping of HTML in JSX Fragments allows for Cross-Site Scripting (XSS)
Packages
Details
As written in the advisory (Markdown source, shown as plain text).
Inserts/JSX expressions inside illegal inlined JSX fragments lacked escaping, allowing user input to be rendered as HTML when put directly inside JSX fragments.
For instance, `?text=<svg/onload=alert(1)>` would trigger XSS here.
```js
const [text] = createResource(() => {
return new URL(getRequestEvent().request.url).searchParams.get("text");
});
return (
<>
Text: {text()}
</>
);
```
References
External links from the advisory. They lead to third-party sites.