Merge pull request gchq#1549 from brun0ne/fix-xss

Fixed xss in addOperation
BRAVO68WEB · Feb 4, 2024 · 75c4e19 · 75c4e19
2 parents fd77152 + 0359a2e
commit 75c4e19
Showing 1 changed file with 5 additions and 1 deletion.
diff --git a/src/web/waiters/RecipeWaiter.mjs b/src/web/waiters/RecipeWaiter.mjs
@@ -396,7 +396,11 @@ class RecipeWaiter {
         const item = document.createElement("li");
 
         item.classList.add("operation");
-        item.innerHTML = name;
+
+        if (this.app.operations[name] != null) {
+            item.innerHTML = name;
+        }
+
         this.buildRecipeOperation(item);
         document.getElementById("rec-list").appendChild(item);