Fix DOM XSS vectors across pages and prepare 2.0.1 bugfix release

Agent-Logs-Url: https://github.com/th30d4y/IP/sessions/6013f9b8-efa5-4d7e-a703-44d539e8bb47

Co-authored-by: Stalin-143 <161853795+Stalin-143@users.noreply.github.com>

Author: Copilot

SECURITY_FIXES.md

@@ -276,5 +276,6 @@ curl -I http://localhost:3000
 
 ---
 
+**Release:** 2.0.1 (bugfix)  
 **Last Updated:** April 17, 2026  
 **Status:** All vulnerabilities patched and tested

both.html

@@ -42,48 +42,84 @@ <h1>IP Reputation Checker - Both Services</h1>
     <div class="result" id="result"></div>
 
     <script>
+        const ipv4Regex = /^(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$/;
+        const ipv6Regex = /^(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4})$/;
+
+        function isValidIP(ip) {
+            return ipv4Regex.test(ip) || ipv6Regex.test(ip);
+        }
+
+        function addLabeledValue(container, label, value) {
+            const p = document.createElement("p");
+            const strong = document.createElement("b");
+            strong.textContent = `${label}: `;
+            p.appendChild(strong);
+            p.appendChild(document.createTextNode(value ?? "N/A"));
+            container.appendChild(p);
+        }
+
         async function checkBoth() {
             const ip = document.getElementById("ipInput").value.trim();
             const resultDiv = document.getElementById("result");
 
             if (!ip) {
-                resultDiv.innerHTML = "<p>Please enter a valid IP address.</p>";
+                resultDiv.textContent = "Please enter a valid IP address.";
+                return;
+            }
+
+            if (!isValidIP(ip)) {
+                resultDiv.textContent = "Invalid IP address format. Please enter a valid IPv4 or IPv6 address.";
                 return;
             }
 
-            resultDiv.innerHTML = "<p>Checking AbuseIPDB and VirusTotal...</p>";
+            if (ip.length > 45) {
+                resultDiv.textContent = "IP address is too long.";
+                return;
+            }
+
+            resultDiv.textContent = "Checking AbuseIPDB and VirusTotal...";
 
             try {
-                const abuseResponse = await fetch(`/api/abuseipdb?ip=${ip}`);
+                const abuseResponse = await fetch(`/api/abuseipdb?ip=${encodeURIComponent(ip)}`);
                 const abuseData = await abuseResponse.json();
 
-                const virusResponse = await fetch(`/api/virustotal?ip=${ip}`);
+                const virusResponse = await fetch(`/api/virustotal?ip=${encodeURIComponent(ip)}`);
                 const virusData = await virusResponse.json();
 
-                resultDiv.innerHTML = `
-                    <h3>Results for IP: ${ip}</h3>
-
-                    <h4>AbuseIPDB</h4>
-                    <p><b>Abuse Confidence Score:</b> ${abuseData.data?.abuseConfidenceScore || "N/A"}</p>
-                    <p><b>Categories:</b> ${abuseData.data?.category?.join(", ") || "N/A"}</p>
-                    <p><b>Country:</b> ${abuseData.data?.countryCode || "N/A"}</p>
-                    <p><b>ISP:</b> ${abuseData.data?.isp || "N/A"}</p>
-                    <p><b>Domain:</b> ${abuseData.data?.domain || "N/A"}</p>
-
-                    <h4>VirusTotal</h4>
-                    <p><b>Reputation:</b> ${virusData.data?.attributes?.reputation || "N/A"}</p>
-                    <p><b>Network:</b> ${virusData.data?.attributes?.network || "N/A"}</p>
-                    <p><b>Last Analysis Stats:</b> ${
-                        virusData.data?.attributes?.last_analysis_stats
-                            ? JSON.stringify(virusData.data.attributes.last_analysis_stats)
-                            : "N/A"
-                    }</p>
-                    <p><b>Tags:</b> ${virusData.data?.attributes?.tags?.join(", ") || "N/A"}</p>
-                    <p><b>Whois:</b> ${virusData.data?.attributes?.whois || "N/A"}</p>
-                `;
+                resultDiv.textContent = "";
+
+                const title = document.createElement("h3");
+                title.textContent = `Results for IP: ${ip}`;
+                resultDiv.appendChild(title);
+
+                const abuseHeader = document.createElement("h4");
+                abuseHeader.textContent = "AbuseIPDB";
+                resultDiv.appendChild(abuseHeader);
+
+                addLabeledValue(resultDiv, "Abuse Confidence Score", String(abuseData.data?.abuseConfidenceScore ?? "N/A"));
+                addLabeledValue(resultDiv, "Categories", abuseData.data?.category?.join(", ") ?? "N/A");
+                addLabeledValue(resultDiv, "Country", abuseData.data?.countryCode ?? "N/A");
+                addLabeledValue(resultDiv, "ISP", abuseData.data?.isp ?? "N/A");
+                addLabeledValue(resultDiv, "Domain", abuseData.data?.domain ?? "N/A");
+
+                const virusHeader = document.createElement("h4");
+                virusHeader.textContent = "VirusTotal";
+                resultDiv.appendChild(virusHeader);
+
+                addLabeledValue(resultDiv, "Reputation", String(virusData.data?.attributes?.reputation ?? "N/A"));
+                addLabeledValue(resultDiv, "Network", virusData.data?.attributes?.network ?? "N/A");
+                addLabeledValue(
+                    resultDiv,
+                    "Last Analysis Stats",
+                    virusData.data?.attributes?.last_analysis_stats
+                        ? JSON.stringify(virusData.data.attributes.last_analysis_stats)
+                        : "N/A"
+                );
+                addLabeledValue(resultDiv, "Tags", virusData.data?.attributes?.tags?.join(", ") ?? "N/A");
+                addLabeledValue(resultDiv, "Whois", virusData.data?.attributes?.whois ?? "N/A");
             } catch (error) {
                 console.error(error);
-                resultDiv.innerHTML = "<p>Error fetching data from both services.</p>";
+                resultDiv.textContent = "Error fetching data from both services.";
             }
         }
     </script>

firebaseauth.js

@@ -22,7 +22,7 @@ const db = getFirestore();
 function showMessage(message, divId) {
   const messageDiv = document.getElementById(divId);
   messageDiv.style.display = "block";
-  messageDiv.innerHTML = message;
+  messageDiv.textContent = message;
   messageDiv.style.opacity = 1;
   setTimeout(() => {
     messageDiv.style.opacity = 0;
@@ -104,4 +104,4 @@ signIn.addEventListener('click', async (event) => {
       showMessage("An error occurred during login. Please try again.", "signInMessage");
     }
   }
-});
+});

homepage.html

@@ -128,7 +128,10 @@ <h2>Hacker's Toolkit</h2>
             // Simulate checking connection and user's access pattern (e.g., rate limiting or IP blocking)
             const suspiciousIP = ['malicious_ip_here']; // List of malicious IPs (to be managed on server-side)
             if (suspiciousIP.includes(userIP)) {
-                document.body.innerHTML = "<div class='blocked'>Your IP has been blocked due to suspicious activity.</div>";
+                const blockedMessage = document.createElement("div");
+                blockedMessage.className = "blocked";
+                blockedMessage.textContent = "Your IP has been blocked due to suspicious activity.";
+                document.body.replaceChildren(blockedMessage);
                 return; // Stop further execution for malicious users
             }
 

login.html

@@ -90,7 +90,7 @@ <h1 class="form-title">Sign In</h1>
           const messageDiv = document.getElementById(divId);
           messageDiv.style.color = isError ? "red" : "green";
           messageDiv.style.display = "block";
-          messageDiv.innerHTML = message;
+          messageDiv.textContent = message;
           setTimeout(() => {
               messageDiv.style.display = "none";
           }, 5000);