Patched code sample

from nicegui import ui

# The fix for the specified vulnerability (likely a typo for a real CVE like
# GHSA-5pfj-x39x-gxv5) is not in application-level code but within the NiceGUI
# library itself (version >= 3.5.0). The internal fix ensures that any string
# passed to ui.navigate.history.push or ui.navigate.history.replace is
# properly serialized and cannot break out of its string context to execute
# arbitrary JavaScript.
#
# This code demonstrates the SAFE behavior in a patched version of NiceGUI.
#
# HOW TO VERIFY THE FIX:
# 1. Run this code with a patched NiceGUI version (>= 3.5.0).
# 2. Enter the XSS payload into the input field:    ');alert('XSS');//
# 3. Click the button.
#
# EXPECTED RESULT (FIXED BEHAVIOR):
# The browser's URL will change to include the payload as a URL-encoded string.
# No JavaScript alert will be executed.
#
# VULNERABLE RESULT (for versions < 3.5.0):
# A JavaScript alert box with the message 'XSS' would appear.

@ui.page('/show/{path_part}')
def show_page(path_part: str):
    """A page to navigate to, demonstrating the path is handled safely."""
    ui.label('Safely navigated. The path parameter received is:').classes('text-h6')
    ui.code(path_part)
    ui.link('Go back to main page', '/')

# An input field to represent an attacker-controlled or untrusted string.
user_input = ui.input(
    label="Enter a string for the URL path",
    placeholder="');alert('XSS');//"
).classes('w-96')

def trigger_vulnerable_pattern():
    """
    This function uses the API pattern described in the CVE. It passes an
    untrusted string directly to a navigation function. In a patched
    NiceGUI library, this operation is safe.
    """
    path_value = user_input.value
    target_path = f'/show/{path_value}'

    # This is the function call mentioned in the CVE. In vulnerable versions,
    # the 'target_path' argument was not properly escaped on the frontend,
    # leading to XSS. The fix is internal to how NiceGUI processes this call.
    # Note: history.push() only changes the URL in the browser's history
    # without reloading the page or redrawing the UI in this context.
    ui.navigate.history.push(target_path)

    ui.notify(f"Called ui.navigate.history.push with '{target_path}'")
    ui.label(f"The URL should now end with the encoded path. "
             f"If no alert appeared, the fix is working.")

ui.button('Demonstrate Fix with ui.navigate.history.push',
          on_click=trigger_vulnerable_pattern)

ui.run()