# [GitHub Extension] Unsanitised HTML leading to XSS on GitHub.com

Algolia's Awesome Autocomplete GitHub extension rendered unsanitised search-result HTML into GitHub.com's DOM, letting crafted search queries trigger DOM XSS.

- Payout: hidden
- Severity: high
- Program: Algolia
- Found by: ysx
- Disclosed: 2017-04-24
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/220494
- Library page: https://bugbountylibrary.com/r/h1%3A220494
- Tags: area:os domain:browser impact:integrity kind:bounty platform:hackerone sev:high tech:chromium vuln:xss

**Target:** Browser extension (Awesome Autocomplete for GitHub) injecting into github.com DOM
**Root cause:** The extension inserted search-result/repository-name HTML into the page DOM without sanitisation, so attacker-influenced strings were parsed as markup.
**Steps:**
1. Install latest Awesome Autocomplete for GitHub extension in Chrome/Safari.
2. On GitHub.com search for `'"><img src=x onerror=` and observe a broken `<img>` element and requests to "x" in GitHub's context.
3. Search for `a'"><h1` and observe a JavaScript alert dialog fire due to a repository name being rendered.
**How found:** Researcher suspected the extension rendered search results as HTML and probed with a quote-breaking `<img onerror>` payload to confirm markup injection, then escalated to an `<h1>` payload that fired an alert.
**Exploitation:** Attacker crafts a search query (or controls a repository name) containing HTML/JS that the extension renders unsanitised into github.com's DOM, executing script in the GitHub origin.
**Insight:** Browser extensions that inject autocomplete/search results into a high-value origin (github.com) are a DOM XSS surface: test quote-breaking payloads in the search box to see if result HTML is parsed rather than text-encoded.