Fix(RecipeWaiter): sanitize user input in addOperation to prevent XSS

[0xh3xa]

What:

• Fix(RecipeWaiter): sanitize user input in addOperation to prevent XSS
• Fix: Bug report: Reflected XSS #1802 , Fix: XSS vulnerability in your website #1468

Fix Description:

• Using innerHTML directly introduces a potential XSS vulnerability by allowing injection of malicious code.
• A recommended solution is to sanitize the input using the DOMPurify library: https://www.npmjs.com/package/dompurify.
• If relying on external libraries is not preferred, please let me know and I can suggest an alternative approach.

Behavior Before

output.mp4

Behavior After (fix):

output.mp4

Producing the issue:

• https://gchq.github.io/CyberChef#recipe=%3Cimg_src%3dx_onerror%3d'alert%601%60'/%3E('Space',false)Generate_all_hashes()&input=MzA1MTczMTA5

• https://gchq.github.io/CyberChef#recipe=%3Cimg_src%3dx_onerror%3d'confirm%601%60'/%3E('Space',false)Generate_all_hashes()&input=test

[a3957273]

dompurify is an excellent choice for sanitisation. Whilst in general we prefer minimizing the number of dependencies on this project for any security relevant functionality we should absolutely be using popular implementations wherever possible. Thanks for fixing an XSS issue!