From eb259a1482ea1bb326f8046a8fc17ba59230e34f Mon Sep 17 00:00:00 2001 From: Maksim Eltyshev Date: Thu, 4 Sep 2025 16:02:41 +0200 Subject: [PATCH] fix: Patch react-photoswipe-gallery to prevent XSS in captions --- client/patches/react-photoswipe-gallery+2.2.7.patch | 13 +++++++++++++ 1 file changed, 13 insertions(+) create mode 100644 client/patches/react-photoswipe-gallery+2.2.7.patch diff --git a/client/patches/react-photoswipe-gallery+2.2.7.patch b/client/patches/react-photoswipe-gallery+2.2.7.patch new file mode 100644 index 00000000..a8e0d586 --- /dev/null +++ b/client/patches/react-photoswipe-gallery+2.2.7.patch @@ -0,0 +1,13 @@ +diff --git a/node_modules/react-photoswipe-gallery/dist/gallery.js b/node_modules/react-photoswipe-gallery/dist/gallery.js +index 53cc02c..f4baccb 100644 +--- a/node_modules/react-photoswipe-gallery/dist/gallery.js ++++ b/node_modules/react-photoswipe-gallery/dist/gallery.js +@@ -181,7 +181,7 @@ export const Gallery = ({ + alt + } = pswpInstance.currSlide.data; + // eslint-disable-next-line no-param-reassign +- el.innerHTML = caption || alt || ''; ++ el.textContent = caption || alt || ''; + }); + } + });