shoaib-jamal / rebornxp

The nostalgic Windows XPerience right in your browser!

RebornXP

RebornXP is a web-based desktop environment that brings back the late 2000's personal computing experience right to your desktop, but in a modern way. It emulates the look and feel of Windows XP, providing users with a nostalgic and fun experience while also offering many functional features.

Disclaimer

Microsoft and Windows XP trademarks & logos definitely belong to Microsoft Corporation. All the programs names and logos (Foxit, Flash Player, Firefox, Word, WinRar, Internet Explorer, etc.) are of their rightful copyright holders. RebornXP is purely for the purpose of nostalgia and its source for educational purposes. It is not affiliated with and has not been approved by Microsoft.

rebornxp's Issues

App Store details page is vulnerable to XSS

Describe the bug
When creating a program through the interface at https://xpstore.glitch.me/createapp, a malicious actor can inject HTML, CSS and JavaScript code into the title of the program. When clicked, the code is injected into the users' browser.

To Reproduce
Steps to reproduce the behavior:

1. Go to https://xpstore.glitch.me/createapp
2. Fill out the details
3. Go back to the App Store and click on the newly created program
4. Any of the code that was put in the title is now executed.

Expected behavior
The HTML code is sanitized, and no script is run in the browser.

Desktop (please complete the following information):

• OS: Windows 11
• Browser Mozilla Firefox
• Version 112

xss in messages

sending a message containing will alert 1

Enhancement for website

You can include a game called "Minesweeper" inside your website!

xss in appstore

if you send a message containing it will alert 1

the app store doesn't work

Describe the bug
The app store shows a glitch error screen

To Reproduce
Steps to reproduce the behavior:

1. the app store
2. see error

Expected behavior
the app store

Screenshots

Desktop (please complete the following information):

• OS: chromeOS
• Browser chrome
• Version 118
  edit: I entered the wrong chromeOS version

Viewer error

Describe the bug
It's strange because at one point this was working fine, but now it isn't, even on a brand new clone of the project. After a fresh clone of the project, I am getting a viewer error (see below). Any help would be appreciated. I'm just a hobby developer, working on something for nostalgic purposes.

To Reproduce
Steps to reproduce the behavior:

1. Clone the project
2. Get it running
3. Click on "My Computer" or any file that would open a Finder window.
4. View error

Expected behavior
A clear and concise description of what you expected to happen.

Screenshots

[HMR][Svelte] Unrecoverable HMR error in <Viewer>: next update will trigger a full reload logError @ proxy.js?v=9c918bd9:15 Proxy<Viewer> @ proxy.js?v=9c918bd9:380 create_content_slot @ my_computer.svelte:312 create_slot @ chunk-5K467XFM.js?v=9c918bd9:70 create_fragment @ Window.svelte:285 init @ chunk-5K467XFM.js?v=9c918bd9:1723 Window @ Window.svelte:268 createProxiedComponent @ svelte-hooks.js?v=9c918bd9:341 ProxyComponent @ proxy.js?v=9c918bd9:242 Proxy<Window> @ proxy.js?v=9c918bd9:349 create_fragment @ my_computer.svelte:261 init @ chunk-5K467XFM.js?v=9c918bd9:1723 My_computer @ my_computer.svelte:40 createProxiedComponent @ svelte-hooks.js?v=9c918bd9:341 ProxyComponent @ proxy.js?v=9c918bd9:242 Proxy<My_computer> @ proxy.js?v=9c918bd9:349 launch @ work_space.svelte:38 await in launch (async) (anonymous) @ work_space.svelte:19 set @ chunk-CS6XKSN7.js?v=9c918bd9:30 open @ desktop_folder.svelte:108 dblclick_handler @ desktop_folder.svelte:237 dblclick_handler @ desktop_folder.svelte:241 Show 12 more frames Show less viewer.svelte:32 Uncaught (in promise) TypeError: Cannot read properties of undefined (reading 'location') at instance (viewer.svelte:32:83) at init (chunk-5K467XFM.js?v=9c918bd9:1710:23) at new Viewer (viewer.svelte:69:19) at createProxiedComponent (svelte-hooks.js?v=9c918bd9:341:9) at new ProxyComponent (proxy.js?v=9c918bd9:242:7) at new Proxy<Viewer> (proxy.js?v=9c918bd9:349:11) at Array.create_content_slot (my_computer.svelte:312:82) at create_slot (chunk-5K467XFM.js?v=9c918bd9:70:25) at create_fragment (Window.svelte:285:119) at init (chunk-5K467XFM.js?v=9c918bd9:1723:35) at new Window (Window.svelte:268:24) at createProxiedComponent (svelte-hooks.js?v=9c918bd9:341:9) at new ProxyComponent (proxy.js?v=9c918bd9:242:7) at new Proxy<Window> (proxy.js?v=9c918bd9:349:11) at create_fragment (my_computer.svelte:261:69) at init (chunk-5K467XFM.js?v=9c918bd9:1723:35) instance @ viewer.svelte:32 init @ chunk-5K467XFM.js?v=9c918bd9:1710 Viewer @ viewer.svelte:69 createProxiedComponent @ svelte-hooks.js?v=9c918bd9:341 ProxyComponent @ proxy.js?v=9c918bd9:242 Proxy<Viewer> @ proxy.js?v=9c918bd9:349 create_content_slot @ my_computer.svelte:312 create_slot @ chunk-5K467XFM.js?v=9c918bd9:70 create_fragment @ Window.svelte:285 init @ chunk-5K467XFM.js?v=9c918bd9:1723 Window @ Window.svelte:268 createProxiedComponent @ svelte-hooks.js?v=9c918bd9:341 ProxyComponent @ proxy.js?v=9c918bd9:242 Proxy<Window> @ proxy.js?v=9c918bd9:349 create_fragment @ my_computer.svelte:261 init @ chunk-5K467XFM.js?v=9c918bd9:1723 My_computer @ my_computer.svelte:40 createProxiedComponent @ svelte-hooks.js?v=9c918bd9:341 ProxyComponent @ proxy.js?v=9c918bd9:242 Proxy<My_computer> @ proxy.js?v=9c918bd9:349 launch @ work_space.svelte:38 await in launch (async) (anonymous) @ work_space.svelte:19 set @ chunk-CS6XKSN7.js?v=9c918bd9:30 open @ desktop_folder.svelte:108 dblclick_handler @ desktop_folder.svelte:237 dblclick_handler @ desktop_folder.svelte:241 Show 14 more frames Show less