App Store details page is vulnerable to XSS about rebornxp

[shoaib-jamal]

Hi @HolyNetworkAdapter

Thank you for bringing this issue to my attention regarding the lack of HTML sanitization in RebornXP's interface for adding programs at https://xpstore.glitch.me/createapp.

I appreciate your diligence in identifying this vulnerability. As a hobby project developed solely by myself, I might have overlooked certain security measures. I apologize for any potential risks this may pose to users.

To address the issue, I will immediately work on implementing HTML sanitization measures to ensure that any injected code is properly handled and does not execute in the user's browser. I will thoroughly review the code and apply the necessary fixes to prevent further vulnerabilities

I value your contribution to the security of RebornXP, and I encourage you to report any additional issues or suggestions you may have.

Thank you for helping me improve the security and reliability of RebornXP

[shoaib-jamal]

I'm glad to inform you that the issue with code injection in the window title has been resolved by implementing the encodeHTML() function. This function properly sanitizes the input and prevents any malicious code from being executed. Thank you, @HolyNetworkAdapter, for pointing out this vulnerability.

I'd like to take this opportunity to encourage everyone to contribute to the security and enhancement of RebornXP. If you come across any security issues or have suggestions for improvements, please feel free to open issues or submit pull requests. Your contributions are greatly appreciated.

As for the App Store code, I'd like to mention that it is currently hosted on a remote private location, xpstore.glitch.me. However, RebornXP itself is served on GitHub Pages, which means the code for the App Store isn't directly visible or accessible for improvements by other developers. In the future, I'm planning to port the App Store code to GitHub so that it can be more openly reviewed and enhanced by the community.

Once again, thank you for bringing this issue to my attention, and please don't hesitate to reach out if you have any further questions or concerns. Happy coding!