Auth0 Lock before 11.21.0 allows XSS when additionalSignUpFields is used with an untrusted placeholder.

Affected: npm: auth0-lock

## Overview

Auth0 Lock version 11.20.4 and earlier did not properly sanitize the generated HTML code. Customers using the `additionalSignUpFields` customization option to add a checkbox to the sign-up dialog that are passing a `placeholder` property obtained from an untrusted source (e.g. a query parameter) could allow cross-site scripting (XSS) on their signup pages.

## Am I affected?

You are affected by this vulnerability if all of the following conditions apply:

- You are using Auth0 Lock version 11.20.4 or earlier. - You pass `additionalSignUpFields` as options when initializing Lock which includes a field of type `checkbox` whose `placeholder` value is obtained from an untrusted source.

An example of a vulnerable snippet is the following where the `placeholder` value is partially user-controlled by the `name` query parameter:

```javascript <script> var params = new URLSearchParams(window.location.search); var options = { auth: { redirectUrl: 'http://localhost:12345/callback', responseType: 'code', params: { scope: 'openid email', }, }, additionalSignUpFields: [{ name: 'agree', type: 'checkbox', placeholder: "I agree to Terms and Conditions for " + params.get('name'), }], }; var lock = new Auth0Lock('<CLIENT_ID>', '<TENANT_NAME>.auth0.com', options); lock.show({ allowShowPassword: true, initialScreen…