You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
CodeQL js/reflected-xss (high, CWE-79) — open alerts #62 and #60 from the 2026-06-29 scan. Same pattern already fixed for snowflake-cortex.ts and mcp/oauth-callback.ts in #424; these sibling sites were missed.
Evidence
packages/opencode/src/plugin/xai.ts:330 — const HTML_ERROR = (error: string) => \<!doctype html>...`interpolateserrorMsg(which includes the attacker-controllederror_description` query param) into the HTML response with zero escaping; served at xai.ts:428/437.
packages/opencode/src/plugin/openai/codex.ts:183 — exported renderOAuthError(error) does the same template interpolation; served at codex.ts:260/269.
Exploit path: an OAuth redirect_uri landing with ?error=...&error_description=<script>...</script> renders arbitrary JS in the local callback page (local context, but page origin can reach local services).
What changed (proposed)
Extract one shared HTML-escaping helper (reuse the approach from the fix: open security alerts #424 snowflake-cortex / oauth-callback fix) and apply it in both HTML_ERROR and renderOAuthError.
While in there, grep all plugins for the same res.end(\<!doctype html>...${msg}`)` pattern and fix every occurrence in one pass.
Why
CodeQL
js/reflected-xss(high, CWE-79) — open alerts #62 and #60 from the 2026-06-29 scan. Same pattern already fixed for snowflake-cortex.ts and mcp/oauth-callback.ts in #424; these sibling sites were missed.Evidence
packages/opencode/src/plugin/xai.ts:330—const HTML_ERROR = (error: string) => \<!doctype html>...`interpolateserrorMsg(which includes the attacker-controllederror_description` query param) into the HTML response with zero escaping; served at xai.ts:428/437.packages/opencode/src/plugin/openai/codex.ts:183— exportedrenderOAuthError(error)does the same template interpolation; served at codex.ts:260/269.Exploit path: an OAuth
redirect_urilanding with?error=...&error_description=<script>...</script>renders arbitrary JS in the local callback page (local context, but page origin can reach local services).What changed (proposed)
HTML_ERRORandrenderOAuthError.res.end(\<!doctype html>...${msg}`)` pattern and fix every occurrence in one pass.Acceptance
<script>inerror_descriptionrenders escaped in both plugins' error pages.specgit finishexit 0.