Reflected XSS when using flashMessages or languageDictionary
OverviewVersions before and including `11.30.0` are vulnerable to reflected XSS.  An attacker can execute arbitrary code when the library's`flashMessage` feature is utilized and user input or data from URL parameters is incorporated into the `flashMessage`.`languageDictionary` feature is utilized and user input or data from URL parameters is incorporated into the `languageDictionary`.Am I affected?You are affected by this vulnerability if you are using `auth0-lock` version `11.30.0` or lower and all of the following conditions apply:You are utilizing `flashMessage` feature.User input or data from URL parameters is incorporated into the `flashMessage`.An example of a vulnerable snippet where query parameters are used to populate the `text` property of a `flashMessage`.ORYou are utilizing `languageDictionary` feature.User input or data from URL parameters is used in `languageDictionary` properties.An example of a vulnerable snippet where query parameters are used to populate the `socialLoginInstructions` property of a `languageDictionary`.How to fix that?Upgrade to version `11.30.1`.Will this update impact my users?The fix uses [DOMPurify](https://github.com/cure53/DOMPurify) to sanitise the `flashMessage` and `languageDictionary` inputs. If you are including inline JavaScript in these fields, like `script` tags or `onclick` attributes, these will be removed.