Update settings-sync.js

[i5d6]

A DOM-based XSS vulnerability exists due to the use of .html(message) without proper sanitization. If the message variable can be influenced by an attacker, arbitrary HTML or JavaScript code could be injected and executed in the victim's browser.

Impact:
An attacker could inject malicious scripts that would execute in the context of the victim’s session, leading to potential session hijacking, defacement, or phishing attacks.

Steps to Reproduce:

Find a way to control or inject content into the message variable.

Inject payload like <script>alert('XSS')</script>.

Observe the JavaScript code being executed

Recommendation:

Replace .html(message) with .text(message) to safely display user-provided data without interpreting it as HTML.

Alternatively, sanitize message before using it with .html(), for example using a library like DOMPurify.

$('#sync_progress').show().html(DOMPurify.sanitize(message)).css('color', 'inherit');

Description

Please include a summary of the changes and the related issue.
Please also include relevant motivation and context.
List any dependencies that are required for this change.

Type of change

Please delete options that are not relevant.

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Syntax change (non-breaking change which fixes code modularity, linting or phpcs issues)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)

Checklist

• [] I have commented my code, particularly in hard-to-understand areas.
• [] I have confirmed that my changes do not introduce any new PHPCS warnings or errors.
• [] I have checked plugin debug logs that my changes do not introduce any new PHP warnings or FATAL errors.
• [] I followed general Pull Request best practices. Meta employees to follow this wiki.
• [] I have added tests (if necessary) and all the new and existing unit tests pass locally with my changes.
• [] I have completed dogfooding and QA testing, or I have conducted thorough due diligence to ensure that it does not break existing functionality.
• [] I have updated or requested update to plugin documentations (if necessary). Meta employees to follow this wiki.

Changelog entry

One liner entry to be surfaced in changelog.txt

Test Plan

Please describe the tests that you ran to verify your changes.
Provide instructions so we can reproduce.
Please also list any relevant details for your test configuration.

Screenshots

Please provide screenshots or snapshots of the system/state both before and after implementing the changes, if appropriate

Before

After