DOM XSS in Cesium InfoBox via unsanitized ?gs name (requires ground-station click)

[Fuzz0X]

Summary

There is a DOM XSS in InfoBox description rendering.

groundStations is deserialized from the gs query parameter, and the optional name field is
inserted into HTML templates without escaping.
That HTML is then rendered by Cesium InfoBox using innerHTML inside the InfoBox iframe.

In this project, the InfoBox iframe sandbox is explicitly relaxed to include allow-scripts, which
makes script execution from injected HTML practical.

Affected Code

  - `src/stores/sat.js`
    - `groundStations` URL sync deserializer reads untrusted `gs` name (`g[2]`) directly.
  - `src/modules/CesiumController.js`
    - `setGroundStations(...)` forwards untrusted `gs.name` into ground station entities.
    - `styleInfoBox()` sets iframe sandbox to `allow-same-origin allow-popups allow-forms allow-scripts`.
  - `src/modules/util/DescriptionHelper.js`
    - `renderGroundstationDescription()` inserts `${name}` into HTML without escaping.
    - `renderSatelliteDescription()` and `renderPass()` also interpolate unescaped text into HTML.
    - `renderPass()` uses inline `onclick` with interpolated JSON.

Realistic Trigger Conditions

• Victim opens a crafted URL containing malicious gs.
• Victim clicks the ground-station marker so the InfoBox is rendered.
• Then injected HTML/JS executes in the app origin context.

Note: lat=0 or lon=0 is filtered in current code (if (!gs.lat || !gs.lon) return;), so PoCs
should use non-zero coordinates.

Reproduction

1. Start the app (e.g. local dev server).
2. Open a crafted URL, e.g.:
   • /?gs=48.1371,11.5754,%3Cimg%20src%3Dx%20onerror%3Dalert(document.domain)%3E
3. Click the injected ground station marker on the globe.
4. Observe JavaScript execution from the injected payload.

Expected vs Actual

• Expected: Untrusted values from URL and TLE-derived display fields are encoded/sanitized before
  insertion, and InfoBox rendering does not allow script execution from attacker-controlled input.
• Actual: Untrusted values are interpolated into HTML directly and rendered via innerHTML in an
  iframe that allows scripts.

Impact

• Arbitrary JavaScript execution in the satvis origin context (client-side).
• Frontend state manipulation (e.g. via exposed window.cc APIs, time/view changes).
• Access to same-origin readable browser data (e.g. localStorage, non-HttpOnly cookies).
• Potential chaining with other client-side issues.

Suggested Remediation

1. HTML-escape all untrusted interpolations in DescriptionHelper (name, pass name, etc.).
2. Remove inline event handlers (onclick=...), and bind events programmatically.
3. Validate/sanitize gs input (especially name) at deserialization.
4. Keep InfoBox sandbox restrictive; remove allow-scripts if possible.
5. Add regression tests for payloads like <img onerror=...> and quote-breaking attribute payloads.