Skip to content

Commit 4c5e122

Browse files
0x5t4l1n0x5t4l1n
authored
Merge pull request #4 from th30d4y/copilot/fix-known-vulnerabilities
Patch DOM XSS vectors and cut 2.0.1 security bugfix release
2 parents 2683b14 + 4fef7f3 commit 4c5e122

17 files changed

Lines changed: 2156 additions & 1967 deletions

‎SECURITY_FIXES.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -276,5 +276,6 @@ curl -I http://localhost:3000
276276

277277
---
278278

279+
**Release:** 2.0.1 (bugfix)
279280
**Last Updated:** April 17, 2026
280281
**Status:** All vulnerabilities patched and tested

‎abuse.html‎

Lines changed: 15 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -90,7 +90,7 @@ <h1>IP Reputation Checker - AbuseIPDB</h1>
9090

9191
const abuseData = await abuseResponse.json();
9292

93-
resultDiv.innerHTML = ''; // Clear previous results
93+
resultDiv.textContent = ""; // Clear previous results
9494

9595
const title = document.createElement('h3');
9696
title.textContent = `Results for IP: ${ip}`;
@@ -100,30 +100,20 @@ <h1>IP Reputation Checker - AbuseIPDB</h1>
100100
abuseHeader.textContent = 'AbuseIPDB';
101101
resultDiv.appendChild(abuseHeader);
102102

103-
const scoreP = document.createElement('p');
104-
scoreP.innerHTML = '<b>Abuse Confidence Score:</b> ';
105-
scoreP.appendChild(document.createTextNode(abuseData.data?.abuseConfidenceScore || 'N/A'));
106-
resultDiv.appendChild(scoreP);
107-
108-
const categoriesP = document.createElement('p');
109-
categoriesP.innerHTML = '<b>Categories:</b> ';
110-
categoriesP.appendChild(document.createTextNode(abuseData.data?.category?.join(", ") || 'N/A'));
111-
resultDiv.appendChild(categoriesP);
112-
113-
const countryP = document.createElement('p');
114-
countryP.innerHTML = '<b>Country:</b> ';
115-
countryP.appendChild(document.createTextNode(abuseData.data?.countryCode || 'N/A'));
116-
resultDiv.appendChild(countryP);
117-
118-
const ispP = document.createElement('p');
119-
ispP.innerHTML = '<b>ISP:</b> ';
120-
ispP.appendChild(document.createTextNode(abuseData.data?.isp || 'N/A'));
121-
resultDiv.appendChild(ispP);
122-
123-
const domainP = document.createElement('p');
124-
domainP.innerHTML = '<b>Domain:</b> ';
125-
domainP.appendChild(document.createTextNode(abuseData.data?.domain || 'N/A'));
126-
resultDiv.appendChild(domainP);
103+
const addLabeledValue = (label, value) => {
104+
const p = document.createElement("p");
105+
const strong = document.createElement("b");
106+
strong.textContent = `${label}: `;
107+
p.appendChild(strong);
108+
p.appendChild(document.createTextNode(value ?? "N/A"));
109+
resultDiv.appendChild(p);
110+
};
111+
112+
addLabeledValue("Abuse Confidence Score", String(abuseData.data?.abuseConfidenceScore ?? "N/A"));
113+
addLabeledValue("Categories", abuseData.data?.category?.join(", ") ?? "N/A");
114+
addLabeledValue("Country", abuseData.data?.countryCode ?? "N/A");
115+
addLabeledValue("ISP", abuseData.data?.isp ?? "N/A");
116+
addLabeledValue("Domain", abuseData.data?.domain ?? "N/A");
127117
} catch (error) {
128118
console.error(error);
129119
resultDiv.textContent = 'Error fetching data from AbuseIPDB.';

‎both.html‎

Lines changed: 50 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -42,48 +42,74 @@ <h1>IP Reputation Checker - Both Services</h1>
4242
<div class="result" id="result"></div>
4343

4444
<script>
45+
function addLabeledValue(container, label, value) {
46+
const p = document.createElement("p");
47+
const strong = document.createElement("b");
48+
strong.textContent = `${label}: `;
49+
p.appendChild(strong);
50+
p.appendChild(document.createTextNode(value ?? "N/A"));
51+
container.appendChild(p);
52+
}
53+
54+
const MAX_IP_LENGTH = 45;
55+
4556
async function checkBoth() {
4657
const ip = document.getElementById("ipInput").value.trim();
4758
const resultDiv = document.getElementById("result");
4859

4960
if (!ip) {
50-
resultDiv.innerHTML = "<p>Please enter a valid IP address.</p>";
61+
resultDiv.textContent = "Please enter a valid IP address.";
5162
return;
5263
}
5364

54-
resultDiv.innerHTML = "<p>Checking AbuseIPDB and VirusTotal...</p>";
65+
if (ip.length > MAX_IP_LENGTH) {
66+
resultDiv.textContent = "IP address is too long.";
67+
return;
68+
}
69+
70+
resultDiv.textContent = "Checking AbuseIPDB and VirusTotal...";
5571

5672
try {
57-
const abuseResponse = await fetch(`/api/abuseipdb?ip=${ip}`);
73+
const abuseResponse = await fetch(`/api/abuseipdb?ip=${encodeURIComponent(ip)}`);
5874
const abuseData = await abuseResponse.json();
5975

60-
const virusResponse = await fetch(`/api/virustotal?ip=${ip}`);
76+
const virusResponse = await fetch(`/api/virustotal?ip=${encodeURIComponent(ip)}`);
6177
const virusData = await virusResponse.json();
6278

63-
resultDiv.innerHTML = `
64-
<h3>Results for IP: ${ip}</h3>
79+
resultDiv.textContent = "";
80+
81+
const title = document.createElement("h3");
82+
title.textContent = `Results for IP: ${ip}`;
83+
resultDiv.appendChild(title);
84+
85+
const abuseHeader = document.createElement("h4");
86+
abuseHeader.textContent = "AbuseIPDB";
87+
resultDiv.appendChild(abuseHeader);
88+
89+
addLabeledValue(resultDiv, "Abuse Confidence Score", String(abuseData.data?.abuseConfidenceScore ?? "N/A"));
90+
addLabeledValue(resultDiv, "Categories", abuseData.data?.category?.join(", ") ?? "N/A");
91+
addLabeledValue(resultDiv, "Country", abuseData.data?.countryCode ?? "N/A");
92+
addLabeledValue(resultDiv, "ISP", abuseData.data?.isp ?? "N/A");
93+
addLabeledValue(resultDiv, "Domain", abuseData.data?.domain ?? "N/A");
6594

66-
<h4>AbuseIPDB</h4>
67-
<p><b>Abuse Confidence Score:</b> ${abuseData.data?.abuseConfidenceScore || "N/A"}</p>
68-
<p><b>Categories:</b> ${abuseData.data?.category?.join(", ") || "N/A"}</p>
69-
<p><b>Country:</b> ${abuseData.data?.countryCode || "N/A"}</p>
70-
<p><b>ISP:</b> ${abuseData.data?.isp || "N/A"}</p>
71-
<p><b>Domain:</b> ${abuseData.data?.domain || "N/A"}</p>
95+
const virusHeader = document.createElement("h4");
96+
virusHeader.textContent = "VirusTotal";
97+
resultDiv.appendChild(virusHeader);
7298

73-
<h4>VirusTotal</h4>
74-
<p><b>Reputation:</b> ${virusData.data?.attributes?.reputation || "N/A"}</p>
75-
<p><b>Network:</b> ${virusData.data?.attributes?.network || "N/A"}</p>
76-
<p><b>Last Analysis Stats:</b> ${
77-
virusData.data?.attributes?.last_analysis_stats
78-
? JSON.stringify(virusData.data.attributes.last_analysis_stats)
79-
: "N/A"
80-
}</p>
81-
<p><b>Tags:</b> ${virusData.data?.attributes?.tags?.join(", ") || "N/A"}</p>
82-
<p><b>Whois:</b> ${virusData.data?.attributes?.whois || "N/A"}</p>
83-
`;
99+
addLabeledValue(resultDiv, "Reputation", String(virusData.data?.attributes?.reputation ?? "N/A"));
100+
addLabeledValue(resultDiv, "Network", virusData.data?.attributes?.network ?? "N/A");
101+
addLabeledValue(
102+
resultDiv,
103+
"Last Analysis Stats",
104+
virusData.data?.attributes?.last_analysis_stats
105+
? JSON.stringify(virusData.data.attributes.last_analysis_stats)
106+
: "N/A"
107+
);
108+
addLabeledValue(resultDiv, "Tags", virusData.data?.attributes?.tags?.join(", ") ?? "N/A");
109+
addLabeledValue(resultDiv, "Whois", virusData.data?.attributes?.whois ?? "N/A");
84110
} catch (error) {
85111
console.error(error);
86-
resultDiv.innerHTML = "<p>Error fetching data from both services.</p>";
112+
resultDiv.textContent = "Error fetching data from both services.";
87113
}
88114
}
89115
</script>

‎firebaseauth.js‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ const db = getFirestore();
2222
function showMessage(message, divId) {
2323
const messageDiv = document.getElementById(divId);
2424
messageDiv.style.display = "block";
25-
messageDiv.innerHTML = message;
25+
messageDiv.textContent = message;
2626
messageDiv.style.opacity = 1;
2727
setTimeout(() => {
2828
messageDiv.style.opacity = 0;
@@ -104,4 +104,4 @@ signIn.addEventListener('click', async (event) => {
104104
showMessage("An error occurred during login. Please try again.", "signInMessage");
105105
}
106106
}
107-
});
107+
});

‎homepage.html‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -128,7 +128,10 @@ <h2>Hacker's Toolkit</h2>
128128
// Simulate checking connection and user's access pattern (e.g., rate limiting or IP blocking)
129129
const suspiciousIP = ['malicious_ip_here']; // List of malicious IPs (to be managed on server-side)
130130
if (suspiciousIP.includes(userIP)) {
131-
document.body.innerHTML = "<div class='blocked'>Your IP has been blocked due to suspicious activity.</div>";
131+
const blockedMessage = document.createElement("div");
132+
blockedMessage.className = "blocked";
133+
blockedMessage.textContent = "Your IP has been blocked due to suspicious activity.";
134+
document.body.replaceChildren(blockedMessage);
132135
return; // Stop further execution for malicious users
133136
}
134137

‎login.html‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -90,7 +90,7 @@ <h1 class="form-title">Sign In</h1>
9090
const messageDiv = document.getElementById(divId);
9191
messageDiv.style.color = isError ? "red" : "green";
9292
messageDiv.style.display = "block";
93-
messageDiv.innerHTML = message;
93+
messageDiv.textContent = message;
9494
setTimeout(() => {
9595
messageDiv.style.display = "none";
9696
}, 5000);

0 commit comments

Comments
 (0)