fix: encode author names in onerror fallback to prevent XSS - #142
Merged
Conversation
The onerror handlers on testimonial avatar images interpolate t.author directly into a JavaScript string literal. Because browsers decode HTML entities before executing event handler attributes, a single quote in an author name (e.g. O'Malley) breaks out of the JS string and enables arbitrary script execution. Apply encodeURIComponent() at build time so special characters are percent-encoded, which both prevents the string breakout and properly URL-encodes the ui-avatars.com name parameter. Affects index.astro (2 instances) and shoutouts.astro (1 instance). Signed-off-by: Sebastien Tardif <sebtardif@ncf.ca>
|
@SebTardif is attempting to deploy a commit to the Jamie's projects Team on Vercel. A member of the Team first needs to authorize it. |
This was referenced May 17, 2026
SebTardif
added a commit
to SebTardif/openclaw.ai
that referenced
this pull request
May 24, 2026
… XSS
URL fields from JSON data files (testimonials.json, testimonials-extra.json,
community-builds.json, press.json) are rendered directly in <a href={...}>
attributes. Astro auto-escapes HTML entities but does not block dangerous
protocols like javascript:, data:, or vbscript:.
If a crafted URL like javascript:alert(document.cookie) were merged via a
community PR, it would render as a clickable XSS link on the homepage,
shoutouts, showcase, and press pages.
This adds a sanitizeUrl() utility that validates URL protocols at build time,
allowing only http:, https:, and mailto:. Dangerous protocols are replaced
with #. All existing URLs are https:// so there is no behavioral change.
Follows up on openclaw#140 and openclaw#142 which fixed related XSS vectors.
Signed-off-by: Sebastien Tardif <sebtardif@ncf.ca>
This was referenced Jul 10, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The
onerrorhandlers on testimonial avatar<img>elements inindex.astroandshoutouts.astrointerpolatet.authordirectly into a JavaScript string literal:onerror="this.src='https://ui-avatars.com/api/?name=${t.author}&...'"Astro HTML-encodes the attribute value, but browsers decode HTML entities before executing
onerrorJavaScript. An author name containing a single quote (e.g.O'Malley) produces a string literal breakout that enables arbitrary script execution.The testimonial data comes from contributor-submitted JSON files (
testimonials.json,testimonials-extra.json), making this a supply-chain XSS vector.Fix
Apply
encodeURIComponent()tot.authorat build time. This percent-encodes special characters, which both prevents the JS string breakout and properly URL-encodes thenameparameter for the ui-avatars.com API.Changes
src/pages/index.astro: 2onerrorhandlers (row1 and row2 testimonial carousels)src/pages/shoutouts.astro: 1onerrorhandlerVerification
astro buildpasses with no errorsonerrorattribute