Update js.js DOM text reinterpreted as HTML #38756

Shivam7-1 · 2024-05-25T13:21:48Z

Description (*)

By using innerText, it will avoid the risk of HTML injection, as these properties automatically escape any HTML special characters in the provided text. This helps prevent cross-site scripting (XSS) vulnerabilities by treating the input as plain text rather than interpreted HTML.

Contribution checklist (*)

Pull request has a meaningful description of its purpose
All commits are accompanied by meaningful commit messages
All new or changed code is covered with unit/integration tests (if applicable)
README.md files for modified modules are updated and included in the pull request if any README.md predefined sections require an update
All automated tests passed successfully (all builds are green)

Resolved issues:

resolves [Issue] Update js.js DOM text reinterpreted as HTML #38767: Update js.js DOM text reinterpreted as HTML

m2-assistant · 2024-05-25T13:21:51Z

Hi @Shivam7-1. Thank you for your contribution!
Here are some useful tips on how you can test your changes using Magento test environment.

Add the comment under your pull request to deploy test or vanilla Magento instance:

@magento give me test instance - deploy test instance based on PR changes
@magento give me 2.4-develop instance - deploy vanilla Magento instance

❗ Automated tests can be triggered manually with an appropriate comment:

@magento run all tests - run or re-run all required tests against the PR changes
@magento run <test-build(s)> - run or re-run specific test build(s)
For example: @magento run Unit Tests

<test-build(s)> is a comma-separated list of build names.

Allowed build names are:

Database Compare
Functional Tests CE
Functional Tests EE
Functional Tests B2B
Integration Tests
Magento Health Index
Sample Data Tests CE
Sample Data Tests EE
Sample Data Tests B2B
Static Tests
Unit Tests
WebAPI Tests
Semantic Version Checker

You can find more information about the builds here
ℹ️ Run only required test builds during development. Run all test builds before sending your pull request for review.

For more details, review the Code Contributions documentation.
Join Magento Community Engineering Slack and ask your questions in #github channel.

Shivam7-1 · 2024-05-25T13:31:11Z

@magento run all tests

Shivam7-1 · 2024-05-25T13:32:00Z

@magento run all tests

engcom-Charlie · 2024-05-28T11:40:36Z

@magento create issue

m2-assistant · 2024-10-22T05:51:04Z

Hi @Shivam7-1. Thank you for your contribution!
Here are some useful tips on how you can test your changes using Magento test environment.
❗ Automated tests can be triggered manually with an appropriate comment:

@magento run all tests - run or re-run all required tests against the PR changes
@magento run <test-build(s)> - run or re-run specific test build(s)
For example: @magento run Unit Tests

<test-build(s)> is a comma-separated list of build names.

Allowed build names are:

Database Compare
Functional Tests CE
Functional Tests EE
Functional Tests B2B
Integration Tests
Magento Health Index
Sample Data Tests CE
Sample Data Tests EE
Sample Data Tests B2B
Static Tests
Unit Tests
WebAPI Tests
Semantic Version Checker

You can find more information about the builds here
ℹ️ Run only required test builds during development. Run all test builds before sending your pull request for review.

For more details, review the Code Contributions documentation.
Join Magento Community Engineering Slack and ask your questions in #github channel.

Shivam7-1 · 2024-10-22T06:58:14Z

@magento run all tests

Shivam7-1 · 2024-12-03T04:05:31Z

Hii @engcom-Charlie , @engcom-Dash @engcom-Bravo and @engcom-Hotel Could You Please Review This PR
As Soon As Possible Because its pending for Review since many months

Thanks & Regards

Shivam7-1 · 2024-12-06T16:12:31Z

Hii @engcom-Charlie , @engcom-Dash @engcom-Bravo and @engcom-Hotel Could You Please Review This PR
As Soon As Possible Because its pending for Review since many months

Thanks & Regards

engcom-Hotel · 2024-12-09T09:50:42Z

@magento run all tests

engcom-Hotel

Hello @Shivam7-1,

Please let us know the steps to reproduce the actual issue for this PR that has been created.

Thanks

Shivam7-1 · 2024-12-09T10:54:50Z

Hii @engcom-Hotel Thanks For Reviewing Here innerText is indeed Preferable over here instead of innerHtml which makes code more safer
Eg https://www.freecodecamp.org/news/innerhtml-vs-innertext-vs-textcontent/

Shivam7-1 · 2024-12-09T16:24:50Z

Hii @engcom-Hotel Could You Please Review This again
Thanks

Shivam7-1 · 2024-12-16T05:49:04Z

Hii @engcom-Hotel @engcom-Bravo @engcom-Dash Thanks For Reviewing PR
Is there anything Else is required from my side to get PR merge ?
Regards

engcom-Hotel · 2024-12-16T06:38:06Z

Hello @Shivam7-1,

At this stage, no action is required from your side. The PR is currently in the testing bucket and will be progressed based on priority. We appreciate your patience.

Thanks

Shivam7-1 · 2024-12-19T09:00:24Z

Hii @engcom-Hotel Thanks For Reply Could You Ping anyone from Team for Testing
So it would get fast-track in Process as PR is much older

Thanks

Shivam7-1 · 2024-12-23T09:55:38Z

Hii @engcom-Hotel @engcom-Charlie @engcom-Bravo Could you Please ping tester here for tasting and get merge this PR

So it will get merge Soon
Thanks

engcom-Charlie · 2024-12-23T12:50:25Z

Hi @Shivam7-1,

Thank you for your contribution!

Currently team is working on other priority tasks. We will pick this PR for further activities as per the priority.

Thank you!

Shivam7-1 · 2025-01-01T09:48:21Z

Hii @engcom-Hotel Thanks For Response
Is there any Update on this PR Testing?

Shivam7-1 · 2025-01-03T09:07:32Z

Hii @engcom-Charlie have you assign this PR for Testing?

Shivam7-1 · 2025-01-07T06:03:24Z

Hii @engcom-Hotel @engcom-Charlie @engcom-Bravo @engcom-Dash Could Team Ping anyone from Team for Testing
So it would get fast-track in Process as PR is much older

Thanks

engcom-Charlie · 2025-01-13T14:27:58Z

@magento run all tests

Shivam7-1 · 2025-01-14T09:29:49Z

Hii @engcom-Charlie Is there any update on above test ?
Thanks

engcom-Charlie · 2025-01-15T06:47:46Z

Hi @Shivam7-1,

Thanks for the collaboration & contribution!

✔️ QA Passed

Preconditions:

Install fresh Magento 2.4-develop
Modify validation error message in lib/web/mage/validation.js eg.

Steps to reproduce

Go to Storefront
Click on Create Account
Add wrong email id in Email filed and observe the error message
On PR branch, only the plain text is getting displayed escaping the HTML special characters because of using innerText property.

Before: ✖️

After: ✔️

Builds are failing, hence, moving this PR to Extended Testing to look into it.

Thanks.

engcom-Charlie · 2025-01-15T06:49:41Z

@magento run all tests

Shivam7-1 · 2025-01-15T18:25:28Z

Hii @engcom-Charlie Is there any update on above test ?
Thanks

engcom-Charlie · 2025-01-16T03:10:01Z

@magento run all tests

engcom-Charlie · 2025-01-16T03:11:56Z

Hi @Shivam7-1,

As mentioned here, we are looking into the build test failures. Currently no action is required from your side. We will let you know if its needed.

Thank you!

engcom-Charlie · 2025-01-16T06:33:03Z

@magento run Functional Tests B2B, Functional Tests CE, Functional Tests EE, Integration Tests

engcom-Charlie · 2025-01-16T10:18:50Z

Some of the Functional CE test failures are not consistent in recent 2 builds and the consistent once are the known issues.Neither they are failing because of this PR nor part of this PR.

Run 1:
https://public-results-storage-prod.magento-testing-service.engineering/reports/magento/magento2/pull/38756/fe504e355935f9594267871c065d0d2a/Functional/allure-report-ce/index.html#categories/b687f15aea026e613d3b0ad4a593aa22/d8b00804567a96df/

Run 2:
https://public-results-storage-prod.magento-testing-service.engineering/reports/magento/magento2/pull/38756/ece35a07807cd440af96f1003c0172bd/Functional/allure-report-ce/index.html#categories/7ea7ba6098fd5dba93af4c6a9157469a/e3aa1c60fcbde546/

Known issues:
ACQE-7464: VerifyDisableDownloadableProductSamplesAreNotAccessibleTest
ACQE-7465: VerifyOutOfStockDownloadableProductSamplesAreAccessibleTest

engcom-Charlie · 2025-01-16T10:50:22Z

Some of the Functional B2B test failures are not consistent in recent 2 builds and the consistent once are the known issues. Neither they are failing because of this PR nor part of this PR.

Run 1:
https://public-results-storage-prod.magento-testing-service.engineering/reports/magento/magento2/pull/38756/46c769a1d661f97913ad1dd6b6e26a2e/Functional/allure-report-b2b/index.html#categories

Run 2:
https://public-results-storage-prod.magento-testing-service.engineering/reports/magento/magento2/pull/38756/18eb80cadc7d800785fe4b447766aa6f/Functional/allure-report-b2b/index.html#categories/12252aa641d411a980bdd869ac7bd814/a76b73840d85896a/

Known issues:
ACQE-7464: VerifyDisableDownloadableProductSamplesAreNotAccessibleTest
ACQE-7465: VerifyOutOfStockDownloadableProductSamplesAreAccessibleTest
ACQE-7387: EndToEndB2CLoggedInUserTest
AC-13447: StorefrontQuoteCanBeRenamedUntilLockedTest
ACQE-7460: CheckingOfPreviewingRegistryUpdateEmailTest

engcom-Charlie · 2025-01-16T10:54:14Z

Some of the Functional EE test failures are not consistent in recent 2 builds and the consistent once are the known issues. Neither they are failing because of this PR nor part of this PR.

Run 1:
https://public-results-storage-prod.magento-testing-service.engineering/reports/magento/magento2/pull/38756/a260929a4a7d67ddcca4e388171f614b/Functional/allure-report-ee/index.html#categories

Run 2:
https://public-results-storage-prod.magento-testing-service.engineering/reports/magento/magento2/pull/38756/89b42d7c7fc9fecb7cda3e586bea38e9/Functional/allure-report-ee/index.html#categories/25ecddfde592b027d2bf7a7bbc5e25ba/5890297edd7bb579/

Known issues:
ACQE-7464: VerifyDisableDownloadableProductSamplesAreNotAccessibleTest
ACQE-7465: VerifyOutOfStockDownloadableProductSamplesAreAccessibleTest
ACQE-7460: CheckingOfPreviewingRegistryUpdateEmailTest

engcom-Charlie · 2025-01-16T11:07:14Z

The Integration test failures are consistent in recent 2 builds and they are the known issues. Neither they are failing because of this PR nor part of this PR. Hence moving this PR to Merge in Progress.

Run 1:
https://public-results-storage-prod.magento-testing-service.engineering/reports/magento/magento2/pull/38756/51bd846f8120ac7f2afe87573e3e7fab/Integration/console-error-logs.html

Run 2:
https://public-results-storage-prod.magento-testing-service.engineering/reports/magento/magento2/pull/38756/0adf949ed4088d09b2187c6c4708e9b8/Integration/console-error-logs.html

Known issues:
ACP2E-3531
AC-13688

Shivam7-1 · 2025-01-20T09:13:06Z

Hii @engcom-Charlie just for confirmation is this PR is Ready to merge or anything is required from my side?
Thanks

Shivam7-1 · 2025-01-30T08:21:12Z

Hii @engcom-Charlie @engcom-Hotel @engcom-Dash any update on this PR regarding merging related ?
Thanks

engcom-Charlie · 2025-02-03T06:30:37Z

Hi @Shivam7-1, As mentioned here, we will let you know if anything is required from your side. We are working on priority work now, will take care of this PR's merging activity as per the priority.

Update js.js

7a40192

Shivam7-1 closed this May 25, 2024

Shivam7-1 reopened this May 25, 2024

m2-community-project bot added the Progress: pending review label May 25, 2024

m2-assistant bot mentioned this pull request May 28, 2024

[Issue] Update js.js DOM text reinterpreted as HTML #38767

Closed

5 tasks

engcom-Charlie added the Priority: P2 A defect with this priority could have functionality issues which are not to expectations. label May 28, 2024

engcom-Hotel mentioned this pull request Jun 21, 2024

Update jquery.metadata.js DOM text reinterpreted as HTML #38836

Open

6 tasks

Shivam7-1 closed this Jul 22, 2024

m2-community-project bot removed the Progress: pending review label Jul 22, 2024

Shivam7-1 reopened this Oct 22, 2024

m2-community-project bot added the Progress: pending review label Oct 22, 2024

Merge branch '2.4-develop' into patch-1

ab14d8b

engcom-Hotel reviewed Dec 9, 2024

View reviewed changes

m2-community-project bot assigned engcom-Hotel Dec 9, 2024

m2-community-project bot added Progress: review and removed Progress: pending review labels Dec 9, 2024

engcom-Hotel added the Progress: needs update label Dec 9, 2024

m2-community-project bot removed the Progress: review label Dec 9, 2024

Shivam7-1 requested a review from engcom-Hotel December 9, 2024 10:55

engcom-Charlie assigned engcom-Charlie and unassigned engcom-Charlie Jan 2, 2025

engcom-Charlie self-assigned this Jan 13, 2025

Merge branch '2.4-develop' into patch-1

5c3f0e4

Merge branch '2.4-develop' into patch-1

b8725e0

Merge branch '2.4-develop' into patch-1

d69f09d

magento-devops-reposync-svc merged commit cb6121a into magento:2.4-develop Feb 24, 2025
8 of 12 checks passed

Update js.js DOM text reinterpreted as HTML #38756

Update js.js DOM text reinterpreted as HTML #38756

Conversation

Shivam7-1 commented May 25, 2024 • edited by m2-assistant bot Loading

Description (*)

Contribution checklist (*)

Resolved issues:

m2-assistant bot commented May 25, 2024

Shivam7-1 commented May 25, 2024

Shivam7-1 commented May 25, 2024

engcom-Charlie commented May 28, 2024

m2-assistant bot commented Oct 22, 2024

Shivam7-1 commented Oct 22, 2024

Shivam7-1 commented Dec 3, 2024 • edited Loading

Shivam7-1 commented Dec 6, 2024

engcom-Hotel commented Dec 9, 2024

engcom-Hotel left a comment

Choose a reason for hiding this comment

Shivam7-1 commented Dec 9, 2024

Shivam7-1 commented Dec 9, 2024

Shivam7-1 commented Dec 16, 2024 • edited Loading

engcom-Hotel commented Dec 16, 2024

Shivam7-1 commented Dec 19, 2024

Shivam7-1 commented Dec 23, 2024

engcom-Charlie commented Dec 23, 2024

Shivam7-1 commented Jan 1, 2025

Shivam7-1 commented Jan 3, 2025

Shivam7-1 commented Jan 7, 2025 • edited Loading

engcom-Charlie commented Jan 13, 2025

Shivam7-1 commented Jan 14, 2025

engcom-Charlie commented Jan 15, 2025 • edited Loading

✔️ QA Passed

engcom-Charlie commented Jan 15, 2025

Shivam7-1 commented Jan 15, 2025

engcom-Charlie commented Jan 16, 2025

engcom-Charlie commented Jan 16, 2025 • edited Loading

engcom-Charlie commented Jan 16, 2025

engcom-Charlie commented Jan 16, 2025 • edited Loading

engcom-Charlie commented Jan 16, 2025 • edited Loading

engcom-Charlie commented Jan 16, 2025 • edited Loading

engcom-Charlie commented Jan 16, 2025

Shivam7-1 commented Jan 20, 2025

Shivam7-1 commented Jan 30, 2025

engcom-Charlie commented Feb 3, 2025

Shivam7-1 commented May 25, 2024 •

edited by m2-assistant bot

Loading

Shivam7-1 commented Dec 3, 2024 •

edited

Loading

Shivam7-1 commented Dec 16, 2024 •

edited

Loading

Shivam7-1 commented Jan 7, 2025 •

edited

Loading

engcom-Charlie commented Jan 15, 2025 •

edited

Loading

engcom-Charlie commented Jan 16, 2025 •

edited

Loading

engcom-Charlie commented Jan 16, 2025 •

edited

Loading

engcom-Charlie commented Jan 16, 2025 •

edited

Loading

engcom-Charlie commented Jan 16, 2025 •

edited

Loading