fixed another xss

3r1s-s · Oct 19, 2024 · f79901f · f79901f
1 parent fdf8b5a
commit f79901f
Showing 1 changed file with 4 additions and 4 deletions.
diff --git a/profile/script.js b/profile/script.js
@@ -99,17 +99,17 @@ function fetchprofile() {
                         <span class="subheader">Last.FM</span>
                         <div class="sec">
                             <div class="spotify">
-                                <div class="spotify-art" style="background-image: url('${data.track.image[2]['#text']}')"></div>
+                                <div class="spotify-art" style="background-image: url('${escapeHTML(data.track.image[2]['#text'])}')"></div>
                                 <div class="spotify-info">
                                     <div class="sp-in-list">
                                         <span style="font-weight: 800;">
-                                        ${data.track.name}
+                                        ${escapeHTML(data.track.name)}
                                         </span>
                                         <span style="font-weight: 400;">
-                                            by ${data.track.artist['#text']}
+                                            by ${escapeHTML(data.track.artist['#text'])}
                                         </span>
                                         <span style="font-weight: 400;">
-                                            on ${data.track.album['#text']}
+                                            on ${escapeHTML(data.track.album['#text'])}
                                         </span>
                                     </div>
                                 </div>