Potential XSS vulnerability with data-background-video attribute

[EastSun5566]

Hi @hakimel

Thanks for all your hard work!

we've encountered a potential security issue related to XSS (Cross-Site Scripting) when using the data-background-video attribute in slides. It appears that the way Reveal.js handles this attribute might allow for the execution of injected scripts, even when the attribute value is HTML entity-encoded.

Consider the following example where we use an encoded string in the data-background-video attribute:

<section data-background-video="&quot;&gt;&lt;/video&gt;&lt;iframe srcdoc=&quot;&lt;script src='https://www.google.com/complete/search?client=chrome&q=123&jsonp=alert(document.domain)//'&gt;&lt;/script&gt;&quot;&gt;&lt;/iframe&gt;&lt;img src=wtf:&gt;&lt;a data-x=&quot;">
	<h2>🍦</h2>
</section>

The script will be executed despite being encoded. because getAttribute will decode entities even if they are already escaped:

reveal.js/js/controllers/slidecontent.js

Line 102 in c239642

backgroundVideo = slide.getAttribute( 'data-background-video' ),

And then concat in innerHTML will cause XSS:

reveal.js/js/controllers/slidecontent.js

Lines 144 to 152 in c239642

	backgroundVideo.split( ',' ).forEach( source => {
	let type = getMimeTypeFromFile( source );
	if( type ) {
	video.innerHTML += `<source src="${source}" type="${type}">`;
	}
	else {
	video.innerHTML += `<source src="${source}">`;
	}
	} );

---

Fix is pretty easy I think. Just replace innerHTML with attribute assignment, as shown below:

backgroundVideo.split( ',' ).forEach( source => {
    let type = getMimeTypeFromFile(source);
    let sourceElement = document.createElement('source');
    sourceElement.setAttribute('src', source);
    if( type ) {
        sourceElement.setAttribute('type', type);
    }

    video.appendChild(sourceElement);
});

Using setAttribute ensures that the source remains a plain string.

If this approach seems suitable, I would be happy to create a PR to address this. Thank you for your consideration!

[hakimel]

Thanks for reporting this @EastSun5566! Your proposed fix looks great. If you want to submit it as a PR I'll be happy to merge.