Repository navigation
Conversation
There was a problem hiding this comment.
Pull request overview
This PR successfully addresses a Cross-Site Scripting (XSS) vulnerability in the llm-chat-app-template by replacing unsafe .innerHTML usage with safer alternatives like .textContent and DOM methods. The changes also include dependency updates, configuration formatting improvements, and backend modifications to switch from streaming to non-streaming responses.
Changes:
- Fixed XSS vulnerability in frontend by replacing
.innerHTMLwith.textContentfor user-generated content - Updated backend to use non-streaming API responses with
returnRawResponse: true - Updated dependencies and improved TypeScript/JSON formatting
- Added a new setup script for workers-for-platforms-template
Reviewed changes
Copilot reviewed 6 out of 11 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| llm-chat-app-template/public/chat.js | Replaced .innerHTML with .textContent to prevent XSS attacks |
| llm-chat-app-template/src/index.ts | Modified to return raw streaming response from Workers AI |
| llm-chat-app-template/package.json | Updated dependency versions and improved formatting |
| llm-chat-app-template/wrangler.jsonc | Updated compatibility date and improved formatting |
| llm-chat-app-template/worker-configuration.d.ts | Updated TypeScript type definitions |
| llm-chat-app-template/tsconfig.json | Improved JSON formatting consistency |
| llm-chat-app-template/src/types.ts | Improved TypeScript formatting consistency |
| llm-chat-app-template/public/index.html | Minor CSS formatting improvements |
| workers-for-platforms-template/scripts/setup.js | Added new setup script (not related to XSS fix) |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Resolve the merge conflict with cloudflare/templates main (33 new commits) so PR cloudflare#913 becomes mergeable. llm-chat-app-template resolution (preserve the XSS fix, sync config to main): - public/chat.js, public/index.html: keep the PR's XSS fix (textContent instead of innerHTML); reformat to the repo tab standard - src/index.ts: keep the PR's Workers AI change (model upgrade + returnRawResponse), which pairs with the PR's chat.js response reader - src/types.ts, tsconfig.json: no real content change from the PR; follow main - package.json, package-lock.json, wrangler.jsonc, .gitignore, worker-configuration.d.ts: follow main (current deps, compatibility_date 2025-10-08, preview_icon_url metadata, regenerated types) so templates lint / syncpack / lockfile checks pass - All files normalized to LF; prettier --check passes for the template Verified: tsc --noEmit, wrangler deploy --dry-run, templates lint, syncpack lint.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This PR fixes a Cross-Site Scripting (XSS) vulnerability in the
llm-chat-app-templatewhere user-generated content from the AI chat responses was not properly sanitized before being inserted into the DOM.What was fixed:
.innerHTMLwithout sanitization, allowing potential execution of malicious scripts.innerHTMLwith.textContentfor user-generated content and implemented proper HTML escapingChanges:
public/chat.jsto use safe DOM manipulation methodssrc/index.tspackage.jsonandpackage-lock.jsonChecklist
-templatepackage.jsonis populated<!-- dash-content-start -->and<!-- dash-content-end -->to designate the Dash readme preview.gitignorefile existspackage.jsoncontains adeploycommandpackage.jsoncontainsprivate: trueand noversionfieldNote: This PR is a security fix for an existing template. All template metadata requirements were already satisfied. The changes focus solely on remediating the XSS vulnerability.