Reflected xss vis src parameter

[JesseClarkND]

What version of Hls.js are you using?

1.4.7

What browser (including version) are you using?

Firefox 114.0.1

What OS (including version) are you using?

Windows 10

Test stream

Configuration

{}

Additional player setup steps

No response

Checklist

• The issue observed is not already reported by searching on Github under https://github.com/video-dev/hls.js/issues
• The issue occurs in the stable client (latest release) on https://hlsjs.video-dev.org/demo and not just on my page
• The issue occurs in the latest client (main branch) on https://hlsjs-dev.video-dev.org/demo and not just on my page
• The stream has correct Access-Control-Allow-Origin headers (CORS)
• There are no network errors such as 404s in the browser console when trying to play the stream

Steps to reproduce

1. Merely visit Merely visit
   https://hlsjs.video-dev.org/demo/?src=%22%27%3E%3Cimg%20src%3Dx%20onerror%3Dprompt(1)%3Ejavascript%3Aalert(1)

Expected behaviour

src to be properly parsed before being inserted into HTML

What actually happened?

HTML directly inserted into DOM

Console output

-

Chrome media internals output

No response

[robwalch]

Hi @JesseClarkND,

Would you be willing to submit a PR that checks the input for and deals with XSS tags? See https://github.com/video-dev/hls.js/blob/master/demo/main.js#L20

[robwalch]

Resolved by #6538 in v1.5.13