Security-fix: enhance security by safely parsing HTML

app/assets/js/vendors/magnific-popup.js

@@ -93,8 +93,8 @@ var _mfpOn = function(name, f) {
 			// 1. Create the raw markup (removing the placeholder string first)
 			var rawMarkup = mfp.st.closeMarkup.replace('%title%', '');
 
-			// 2. Parse it into a jQuery object
-			var $btn = $(rawMarkup);
+			// 2. Parse it into a jQuery object SAFELY using $.parseHTML
+			var $btn = $($.parseHTML(rawMarkup));
 
 			// 3. Set the title attribute safely (jQuery handles the escaping)
 			$btn.attr('title', mfp.st.tClose);
@@ -365,10 +365,23 @@ MagnificPopup.prototype = {
 		// add everything to DOM
         var appendToEl = mfp.st.prependTo || $(document.body);
 
-        // FIX: If prependTo is a string, force it to be a selector 
-        // by looking it up inside the body, rather than letting jQuery evaluate it.
-        if (typeof mfp.st.prependTo === 'string') {
-            appendToEl = $(document.body).find(mfp.st.prependTo);
+		if (typeof mfp.st.prependTo === 'string') {
+            // Use document.querySelector to ensure the string is treated 
+            try {
+				// 1. Attempt to query the element
+                var el = document.querySelector(mfp.st.prependTo);
+
+                // 2. Check if the element actually exists (querySelector returns null if not found)
+                if (el) {
+                    appendToEl = $(el);
+                } else {
+                    // Valid selector but element not found in DOM -> Fallback to body
+                    appendToEl = $(document.body);
+				} 
+			} catch (e) {
+                // Fallback to body if the selector is invalid
+                appendToEl = $(document.body);
+            }
         }
 		mfp.bgOverlay.add(mfp.wrap).prependTo( appendToEl );