DOM based Cross-site-scripting vulnerability by injecting JS into the 'message' parameter to the event handler.

Problem/Motivation

Webserver doesn't validate client-supplied data submitted to the event listener on the Integrations Report page.

Pen-testers was able to execute JavaScript in via a DOM based Cross-site-scripting vulnerability by injecting javascript into the 'message' parameter to the event handler.

Steps to reproduce

• Data is read from postMessageJSON and passed to jQuery.append.
• The pen-testers were able to inject use irrelevant tags like img, script etc into the 'message' parameter and those were visible in the integration report page.
• The event listener that receives the message does not validate the origin.
• It appears that the event listener that receives the message doesn't validate the "message" parameter data properly.

Proposed resolution

Added a check to ensure if any irrelevant code is injected in the message through img tag, script tag or any by php code the message is displayed as NULL. Also the message value should be sanitized by using library like DOMPurify to ensure that only safe HTML remains.