From b5c1a0d8a0e91d3beb439150fb0865e9c472eee4 Mon Sep 17 00:00:00 2001
From: Sebastion <sebastion@sebastion.dev>
Date: Sun, 5 Jul 2026 18:02:54 +0100
Subject: [PATCH] fix(lyrics-plus): sanitize Genius HTML before
 dangerouslySetInnerHTML
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

ProviderGenius.fetchLyricsVersion concatenates the raw innerHTML of every
<div data-lyrics-container="true"> from a Genius page and returns the
string to GeniusPage in Pages.js, which renders it via
dangerouslySetInnerHTML.

Genius pages contain crowd-sourced annotations and are fetched through a
plaintext CORS proxy, so their contents are untrusted. An attacker who
can influence a Genius annotation or MitM the proxy response can inject
<script>, <img onerror=...>, <iframe srcdoc=...>, javascript: URLs, or
SVG event handlers that execute inside the Spotify web view — where they
gain access to Spicetify.CosmosAsync (authenticated Spotify HTTP),
Spicetify.LocalStorage, Spicetify.Player, and can persist across
sessions via lyrics-plus:local-lyrics.

Rebuild the lyric HTML from an allow-list of tags (a, br, i, b, em,
strong, span, p, div) and attributes (a[href|data-id]) before returning
it. href values are restricted to http(s)/absolute-path/fragment URLs so
that the annotation-note fetch loop in Pages.js#GeniusPage keeps
working while javascript:/data: URLs are rejected.
---
 CustomApps/lyrics-plus/ProviderGenius.js | 58 +++++++++++++++++++++++-
 1 file changed, 57 insertions(+), 1 deletion(-)

diff --git a/CustomApps/lyrics-plus/ProviderGenius.js b/CustomApps/lyrics-plus/ProviderGenius.js
index d4e254b0fc..376ca49242 100644
--- a/CustomApps/lyrics-plus/ProviderGenius.js
+++ b/CustomApps/lyrics-plus/ProviderGenius.js
@@ -1,4 +1,56 @@
 const ProviderGenius = (() => {
+	// Allow-list of tags that may appear inside a Genius lyric container. Everything
+	// else (script, iframe, img, svg, style, on* handlers, ...) is stripped before
+	// the HTML is handed to `dangerouslySetInnerHTML` in Pages.js#GeniusPage.
+	const ALLOWED_LYRIC_TAGS = new Set(["A", "BR", "I", "B", "EM", "STRONG", "SPAN", "P", "DIV"]);
+	const ALLOWED_LYRIC_ATTRS = {
+		A: new Set(["href", "data-id"]),
+	};
+	const SAFE_HREF = /^(https?:\/\/|\/|#)/i;
+
+	function sanitizeLyricNode(node) {
+		let out = "";
+		for (const child of node.childNodes) {
+			if (child.nodeType === 3 /* TEXT_NODE */) {
+				out += child.textContent.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+				continue;
+			}
+			if (child.nodeType !== 1 /* ELEMENT_NODE */) continue;
+
+			const tag = child.tagName;
+			if (!ALLOWED_LYRIC_TAGS.has(tag)) {
+				// Drop the wrapper but keep its (sanitized) text so lyrics remain readable.
+				out += sanitizeLyricNode(child);
+				continue;
+			}
+
+			const attrs = [];
+			const allowed = ALLOWED_LYRIC_ATTRS[tag];
+			if (allowed) {
+				for (const attr of child.attributes) {
+					if (!allowed.has(attr.name)) continue;
+					let value = attr.value;
+					if (attr.name === "href") {
+						const trimmed = value.trim();
+						// Refuse javascript:, data:, vbscript: and other exotic schemes.
+						if (!SAFE_HREF.test(trimmed)) continue;
+						value = trimmed;
+					}
+					attrs.push(`${attr.name}="${value.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;").replace(/>/g, "&gt;")}"`);
+				}
+			}
+
+			const tagName = tag.toLowerCase();
+			const attrStr = attrs.length ? ` ${attrs.join(" ")}` : "";
+			if (tag === "BR") {
+				out += "<br>";
+			} else {
+				out += `<${tagName}${attrStr}>${sanitizeLyricNode(child)}</${tagName}>`;
+			}
+		}
+		return out;
+	}
+
 	function getChildDeep(parent, isDeep = false) {
 		let acc = "";
 
@@ -81,8 +133,12 @@ const ProviderGenius = (() => {
 		const htmlDoc = parser.parseFromString(body, "text/html");
 		const lyricsDiv = htmlDoc.querySelectorAll('div[data-lyrics-container="true"]');
 
+		// Genius pages contain crowd-sourced annotations and are fetched over a
+		// CORS proxy, so their HTML is untrusted. Rebuild the markup from an
+		// allow-list before returning it — the string is rendered downstream with
+		// `dangerouslySetInnerHTML` in Pages.js#GeniusPage.
 		for (const i of lyricsDiv) {
-			lyrics += `${i.innerHTML}<br>`;
+			lyrics += `${sanitizeLyricNode(i)}<br>`;
 		}
 
 		if (!lyrics?.length) {