Security vulnerabilities and automated fixes for json injection issues
2 posts found
A high-severity cross-site scripting vulnerability existed where untrusted JSON data from bangumis.json was rendered directly into the DOM using insertAdjacentHTML without sanitization. An attacker who could modify this external data source could execute arbitrary JavaScript in visitors' browsers. The fix introduces a dedicated sanitizeBangumiHtml() function that strips script tags, event handlers, and javascript: URLs before insertion.
A medium-severity vulnerability was discovered and patched in `scripts/openai_compat_report.sh`, where shell-based JSON construction using `printf` and variable interpolation left API payloads open to injection attacks. Without proper escaping of special characters, attacker-controlled input could malform JSON or silently alter API request semantics. This post breaks down how the vulnerability works, how it was fixed, and what every developer should know about safe JSON construction in shell scr