From baf213e769e54cc102a5e5be03c9842d00009aa2 Mon Sep 17 00:00:00 2001 From: Meng Meng Date: Fri, 12 Jun 2026 12:00:38 +0800 Subject: [PATCH] Potential fix for code scanning alert no. 28: DOM text reinterpreted as HTML Patch Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> --- Mofang/templates/firewall.html | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/Mofang/templates/firewall.html b/Mofang/templates/firewall.html index 4ca45e4..3450595 100644 --- a/Mofang/templates/firewall.html +++ b/Mofang/templates/firewall.html @@ -204,9 +204,12 @@ return; } rulesContainer.innerHTML = currentRules.map(function(rule, idx) { - var dir = (rule.direction || 'in').toLowerCase(); - var proto = (rule.protocol || 'tcp').toLowerCase(); - var action = (rule.action || 'ACCEPT').toUpperCase(); + var dirRaw = String(rule.direction || 'in').toLowerCase(); + var protoRaw = String(rule.protocol || 'tcp').toLowerCase(); + var actionRaw = String(rule.action || 'ACCEPT').toUpperCase(); + var dir = (dirRaw === 'in' || dirRaw === 'out') ? dirRaw : 'in'; + var proto = (protoRaw === 'tcp' || protoRaw === 'udp' || protoRaw === 'icmp' || protoRaw === 'all') ? protoRaw : 'tcp'; + var action = (actionRaw === 'ACCEPT' || actionRaw === 'DROP' || actionRaw === 'REJECT') ? actionRaw : 'ACCEPT'; var port = escapeHtml(portDisplay(rule.port)); var srcIp = escapeHtml(sourceIpDisplay(rule.source_ip)); var desc = escapeHtml(rule.description || '');