feat: Sds3

[aaronm-2112]

No description provided.

[fairdataihub-bot]

Thank you for submitting this pull request! We appreciate your contribution to the project. Before we can merge it, we need to review the changes you've made to ensure they align with our code standards and meet the requirements of the project. We'll get back to you as soon as we can with feedback. Thanks again!

To fix this vulnerability, we must ensure that any user-controlled data interpolated into HTML is properly escaped so that it is interpreted as text, not as markup. The best way to do this is to escape HTML meta-characters (<, >, &, ", ', and `) in the entity value before inserting it into the template string. This can be done by creating a utility function (e.g., escapeHtml) that replaces these characters with their corresponding HTML entities. We should use this function when interpolating entity into the HTML in renderEntitiesInSwal (lines 99 and 100).

What to change:

• Add an escapeHtml function to the file.
• In renderEntitiesInSwal, use escapeHtml(entity) instead of entity when interpolating into the template string for both the text span and the data-entity-name attribute.

What is needed:

• A new escapeHtml function definition.
• Update the template string in renderEntitiesInSwal to use escapeHtml(entity).

---

To fix this issue, avoid using .html(bfDataset) when inserting user-controllable or DOM-derived string data into the page, as it will be interpreted as HTML and expose the app to XSS. Instead, use .text(bfDataset) to safely insert the value as plain text, ensuring that any HTML meta-characters in bfDataset are properly escaped. Specifically, in src/renderer/src/scripts/globals.js, replace $(".ps-dataset-span").html(bfDataset); on line 1673 with $(".ps-dataset-span").text(bfDataset);. No new imports or major code changes are needed; simply update the jQuery method used to render the dataset name.

---

To fix this issue, we should avoid inserting untrusted user input as HTML. Instead of using .html(renamedDatasetName), which interprets the string as HTML, we should use .text(renamedDatasetName), which safely inserts the string as plain text, escaping any HTML meta-characters. This change should be made on line 410 in src/renderer/src/scripts/manage-dataset/manage-dataset.js. No additional imports or dependencies are required, as jQuery's .text() method is already available.

---

[sourcery-ai]

The pull request #386 has too many files changed.

We can only review pull requests with up to 300 changed files, and this pull request has 1007.

To fix this vulnerability, we need to prevent untrusted text from being interpreted as HTML. The specific sink is the assignment to innerHTML, which interprets its value as HTML. The remedy is to use textContent instead, which sets the element's text without parsing as HTML.

Detailed steps:

• Locate the assignment to innerHTML (document.getElementById("org-dataset-folder-path").innerHTML = folderPath; on line 650 of src/renderer/src/scripts/organize-dataset/curate-functions.js).
• Replace innerHTML with textContent so that any value in folderPath, even if it contains HTML or scripts, will be rendered as plain text.
• No additional libraries or imports are necessary for this change.
• No other code changes are required, and functionality (displaying the folder path) remains unchanged and safe.

---

To fix this problem, we need to ensure that all backslashes in the string are replaced with forward slashes, not just the first one. The best way to do this in JavaScript is to use a regular expression with the global flag: replace(/\\/g, "/"). This will replace every backslash in the string. The change should be made on line 1541 of src/renderer/src/scripts/others/tab-effects.js. No new imports or dependencies are needed, as this is standard JavaScript functionality.

To fix the problem, the code on line 1387 should replace all occurrences of backslash (\) in current_file_path with forward slash (/). This is best achieved by using the replace method with a regular expression /\\/g, which matches all backslashes globally. The change should be made only to line 1387 in the file src/renderer/src/scripts/others/tab-effects.js. No new imports or definitions are needed, as this is a standard JavaScript operation.

To fix the vulnerability, we must explicitly escape any user-controlled values before interpolating them into HTML strings. This especially applies to the newID variable embedded both as the content of a <td> and possibly within an attribute (though not directly in a way that would break out of the attribute context here). The safest way is to encode newID for HTML context using a trusted escaping function.

We will:

• Escape newID before it is inserted into the HTML string in addNewIDToTable.
• Use a well-known library, such as he (HTML Entities), to encode it properly since this is a common approach and avoids subtle mistakes in writing a custom escaper.
• Update only the relevant code in src/renderer/src/scripts/metadata-files/subjects-samples.js by importing he and using it to encode newID in the HTML row construction.

---

The best way to fix this problem is to ensure all user-provided (or otherwise tainted) data included in HTML strings is properly escaped for HTML context before concatenation. Rather than inserting these values directly into the HTML via string interpolation, escape each value using a robust HTML-escaping function. This prevents HTML meta-characters from being interpreted by the browser, rendering them as harmless text instead.

Specifically:

• In the function addNewIDToTable, prior to concatenation in line 329–347, escape newID and secondaryID (as well as any other user-influenced variable, including indexNumber if it is user-controlled, though it looks auto-assigned).
• You may either use a well-known library (like lodash's _.escape, DOMPurify, or a hand-written escape function), or implement your own basic HTML escape for the small cases needed.
• Add the import if using an external library (prefer lodash if allowed, or implement a minimal local function if not).
• Replace direct string interpolation in the vulnerable line(s) to use the escaped values.

Files/regions to change:

• In src/renderer/src/scripts/metadata-files/subjects-samples.js:
  • Define an HTML-escape utility function (if not already imported/available).
  • In addNewIDToTable, escape newID and secondaryID at the point of use.

---