Repository navigation
Stored XSS through library folder names #170
Description
Found a stored XSS issue in the library folder rendering.
catalog.js has an esc() helper and the nearby track render paths use it, but folder names get dropped into innerHTML raw:
<span class="f-name">${folder.name}</span>A folder name like this gets saved and fires again whenever the library renders:
<img src=x onerror=alert(1)>Matters way more in the desktop app because Tauri is exposed globally and CSP is off, so script in the webview can potentially reach Tauri commands.
Prob fix is escaping folder.name there, or rendering the name with textContent instead.
Metadata
Metadata
Assignees
Labels
No labels
Activity
thcp commentedon Jun 2, 2026
Hi @omglazrgunpewpew , thanks for the report, this will be addressed on the next release
feat: validate library folder names (reject symbols/markup)
fix: address open issues #169 (version), #170 (XSS), #173 (SSRF) (#176)
thcp commentedon Jun 2, 2026
Fixed in #176 — folder names are escaped on render now, and there's input validation so you can't even create one containing markup/symbols (plus a 100-char cap). Ships in the next alpha.
feat: add Content-Security-Policy to the webview (#171)
feat: add Content-Security-Policy to the webview (#171) (#177)