[mirotalk] - fix(security): escape /activeRooms renderer (stored XSS)

Author: miroslavpejic85

.env.template

@@ -1,5 +1,5 @@
 # ====================================================
-# MiroTalk P2P v.1.8.36 - Environment Configuration
+# MiroTalk P2P v.1.8.37 - Environment Configuration
 # ====================================================
 
 # App environment

app/src/config.template.js

@@ -2,7 +2,7 @@
 
 /**
  * ==============================================
- * MiroTalk P2P v.1.8.36 - Configuration File
+ * MiroTalk P2P v.1.8.37 - Configuration File
  * ==============================================
  *
  * This file is the central configuration source.

app/src/server.js

@@ -45,7 +45,7 @@ dependencies: {
  * @license For commercial use or closed source, contact us at license.mirotalk@gmail.com or purchase directly from CodeCanyon
  * @license CodeCanyon: https://codecanyon.net/item/mirotalk-p2p-webrtc-realtime-video-conferences/38376661
  * @author  Miroslav Pejic - miroslav.pejic.85@gmail.com
- * @version 1.8.36
+ * @version 1.8.37
  *
  */
 

package-lock.json

@@ -1,6 +1,6 @@
 {
     "name": "mirotalk",
-    "version": "1.8.36",
+    "version": "1.8.37",
     "description": "A free WebRTC browser-based video call",
     "main": "server.js",
     "scripts": {

package.json

@@ -25,6 +25,22 @@ function setRoomsContent(html) {
     roomsDiv.innerHTML = html;
 }
 
+// Security: escape user-controlled strings before injecting into innerHTML.
+function escapeHtml(value) {
+    return String(value ?? '').replace(/[&<>"'`=\/]/g, (c) => {
+        return {
+            '&': '&amp;',
+            '<': '&lt;',
+            '>': '&gt;',
+            '"': '&quot;',
+            "'": '&#39;',
+            '`': '&#96;',
+            '=': '&#61;',
+            '/': '&#47;',
+        }[c];
+    });
+}
+
 function getRoomsData(res) {
     return !isTest ? res.data.activeRooms || [] : mockRooms();
 }
@@ -75,30 +91,33 @@ function renderRooms(rooms) {
     }
     setRoomsContent(
         rooms
-            .map(
-                (room) => `
+            .map((room) => {
+                const id = escapeHtml(room.id);
+                const peers = Number(room.peers) || 0;
+                const join = escapeHtml(room.join);
+                return `
             <div class="room-card">
                 <div class="room-card-header">
                     <div class="room-title">
-                        <i class="fa-solid fa-door-open"></i>${room.id}
+                        <i class="fa-solid fa-door-open"></i>${id}
                     </div>
                     <div class="peer-badge">
                         <i class="fa-solid fa-users"></i>
-                        ${room.peers}
+                        ${peers}
                     </div>
                 </div>
                 <div class="room-card-footer">
                     <div class="peer-status">
                         <span class="dot"></span>
-                        ${room.peers} ${room.peers === 1 ? 'peer' : 'peers'} connected
+                        ${peers} ${peers === 1 ? 'peer' : 'peers'} connected
                     </div>
-                    <a href="${room.join}" class="join-btn" target="_blank">
+                    <a href="${join}" class="join-btn" target="_blank" rel="noopener noreferrer">
                         <i class="fa-solid fa-arrow-right-to-bracket"></i> Join
                     </a>
                 </div>
             </div>
-        `
-            )
+        `;
+            })
             .join('')
     );
 }

public/js/activeRooms.js

@@ -109,7 +109,7 @@ let brand = {
     },
     about: {
         imageUrl: '../images/mirotalk-logo.gif',
-        title: 'WebRTC P2P v1.8.36',
+        title: 'WebRTC P2P v1.8.37',
         html: `
             <button 
                 id="support-button" 

public/js/brand.js

@@ -15,7 +15,7 @@
  * @license For commercial use or closed source, contact us at license.mirotalk@gmail.com or purchase directly from CodeCanyon
  * @license CodeCanyon: https://codecanyon.net/item/mirotalk-p2p-webrtc-realtime-video-conferences/38376661
  * @author  Miroslav Pejic - miroslav.pejic.85@gmail.com
- * @version 1.8.36
+ * @version 1.8.37
  *
  */
 
@@ -15823,7 +15823,7 @@ function showAbout() {
     Swal.fire({
         background: swBg,
         position: 'center',
-        title: brand.about?.title && brand.about.title.trim() !== '' ? brand.about.title : 'WebRTC P2P v1.8.36',
+        title: brand.about?.title && brand.about.title.trim() !== '' ? brand.about.title : 'WebRTC P2P v1.8.37',
         imageUrl: brand.about?.imageUrl && brand.about.imageUrl.trim() !== '' ? brand.about.imageUrl : images.about,
         customClass: { image: 'img-about' },
         html: renderRoomTemplate('tpl-about-modal', {