Conversation
Revamped the link/text to the new event, instead of the current deprecated version
tweak: healedPlayer -> playerHealed
The changes reflect the acquisition of txAdmin by Cfx.re as [announced](https://forum.cfx.re/t/txadmin-officially-joins-cfx-re/5319010).
…d customizable className prop
It's fine to do this without migration because the old version was never published.
Increased timeline legend offset. Increased timeline mouse event debouncing delay. Fixed drilldown loader cards order. Added the script to generate the player drops stats file v2.
This commit tightens up server-side rendering and a few client-side error surfaces to avoid “string-to-HTML/JS context” footguns, and centralizes escaping/sanitizing rules so we don’t have to re-solve this in every route/view. Thank you very much @gtasnail (Kypos) for the report. IMPORTANT NOTE: There’s **no evidence** of these issues being exploited in the wild, and **none of the recent incidents** are related to these issues (or to txAdmin at all). Two specific issues addressed: 1. **Config-driven script context injection via server name** - A crafted value for `txConfig.general.serverName` could be rendered into a sensitive UI boot/script-constants context in a way that allowed arbitrary script execution in the browser. - **Practicality:** triggering this requires **admin-level access** over the txAdmin configuration. This isn’t reachable by regular players/users, but it’s still worth eliminating because it touches a high-risk render context. 2. **Setup recipe validation errors injected into the DOM** - Invalid recipe/template details could influence an error string that was then displayed via `innerHTML` in the setup UI, allowing markup interpretation and script execution. - **Practicality:** the setup flow is **admin master–only**, and the string originates from the recipe/template you are choosing to validate/run. If you’re feeding the setup wizard an untrusted recipe, a browser injection is the least of your problems — but the UI should still treat error strings strictly as text. Defense-in-depth hardening included: - Add `core/lib/htmlRenderSafety.ts` (with tests) for context-appropriate escaping: - text nodes vs quoted attributes vs raw-text elements (`<script>/<style>`), plus minimal safe HTML sanitization for legacy message rendering. - Remove the old `core/lib/xss.js` helper and migrate callers to the new utilities. - Adjust several routes/pages to prefer safe message rendering (`renderMessage`) and avoid passing user-influenced strings (e.g. from errors) into markup/JS contexts without the correct escaping.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.