Security Hardening: Low-severity frontend fixes (grouped)
Issues to address
1. innerHTML for altitude formatting (script.js:1736)
format_altitude_brief() returns a string with HTML set via innerHTML. Currently safe since altitude is numeric, but fragile if data types change. Use DOM manipulation instead.
2. URL params flow into localStorage unsanitized (script.js:826)
URL query parameters are validated as floats 0-5 via restrictUrlRequest(), then stored in localStorage. Add an isFinite() check before storing.
3. flag_image path not validated (script.js:159)
Image src constructed from flag_image + FlagPath. Values come from hardcoded ICAO_Ranges so not attacker-controlled, but validate the pattern for defense-in-depth.
4. No CSRF protection on AJAX fetches (script.js:204)
AJAX requests to data/aircraft.json have no CSRF tokens. Add SameSite cookie consideration or Origin/Referer checks to the HTTP server.
Security Hardening: Low-severity frontend fixes (grouped)
Issues to address
1. innerHTML for altitude formatting (script.js:1736)
format_altitude_brief() returns a string with HTML set via innerHTML. Currently safe since altitude is numeric, but fragile if data types change. Use DOM manipulation instead.
2. URL params flow into localStorage unsanitized (script.js:826)
URL query parameters are validated as floats 0-5 via restrictUrlRequest(), then stored in localStorage. Add an isFinite() check before storing.
3. flag_image path not validated (script.js:159)
Image src constructed from flag_image + FlagPath. Values come from hardcoded ICAO_Ranges so not attacker-controlled, but validate the pattern for defense-in-depth.
4. No CSRF protection on AJAX fetches (script.js:204)
AJAX requests to data/aircraft.json have no CSRF tokens. Add SameSite cookie consideration or Origin/Referer checks to the HTTP server.