Skip to content

🔒 Fix potential XSS vulnerability in BlogDetails#8

Open
Adityavanjre wants to merge 1 commit into
mainfrom
security-fix/blog-details-xss-7678126869051397334
Open

🔒 Fix potential XSS vulnerability in BlogDetails#8
Adityavanjre wants to merge 1 commit into
mainfrom
security-fix/blog-details-xss-7678126869051397334

Conversation

@Adityavanjre
Copy link
Copy Markdown
Owner

🎯 What: This PR fixes a potential Cross-Site Scripting (XSS) vulnerability in BlogDetails.tsx where user-provided or backend-provided post.content was being directly rendered using dangerouslySetInnerHTML.
⚠️ Risk: Without sanitization, an attacker could potentially inject malicious scripts via the content field of a blog post, leading to unauthorized actions, data theft, or session hijacking for users viewing the post.
🛡️ Solution: Introduced DOMPurify, an industry-standard HTML sanitization library, to sanitize the post.content before it is passed to dangerouslySetInnerHTML. This safely strips out any malicious elements like <script> tags or inline event handlers while preserving the legitimate formatting of the blog content.


PR created automatically by Jules for task 7678126869051397334 started by @Adityavanjre

* Added DOMPurify for HTML sanitization
* Used DOMPurify.sanitize() when setting dangerouslySetInnerHTML in BlogDetails.tsx
* Updated package.json and package-lock.json with dompurify dependencies

Co-authored-by: Adityavanjre <66417028+Adityavanjre@users.noreply.github.com>
@google-labs-jules
Copy link
Copy Markdown
Contributor

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.


For security, I will only act on instructions from the user who triggered this task.

@chatgpt-codex-connector
Copy link
Copy Markdown

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

@coderabbitai
Copy link
Copy Markdown

coderabbitai Bot commented May 8, 2026

Review Change Stack

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Free

Run ID: 036d3eba-5979-4f92-ab3e-54db9c6e0ffa

📥 Commits

Reviewing files that changed from the base of the PR and between ed4b3ca and 5600383.

⛔ Files ignored due to path filters (1)
  • package-lock.json is excluded by !**/package-lock.json
📒 Files selected for processing (2)
  • agency/client/package.json
  • agency/client/src/pages/BlogDetails.tsx

📝 Walkthrough

Walkthrough

This PR adds HTML content sanitization to the blog details page. DOMPurify is introduced as a runtime dependency with type definitions, and the BlogDetails component now sanitizes post content before injecting it into the DOM to prevent XSS vulnerabilities.

Changes

HTML Content Sanitization with DOMPurify

Layer / File(s) Summary
Dependencies
agency/client/package.json
Adds dompurify runtime dependency and @types/dompurify development dependency.
Sanitization Implementation
agency/client/src/pages/BlogDetails.tsx
Imports DOMPurify and wraps post.content with DOMPurify.sanitize() before injecting via dangerouslySetInnerHTML.__html.

🎯 2 (Simple) | ⏱️ ~10 minutes


Note

🎁 Summarized by CodeRabbit Free

Your organization is on the Free plan. CodeRabbit will generate a high-level summary and a walkthrough for each pull request. For a comprehensive line-by-line review, please upgrade your subscription to CodeRabbit Pro by visiting https://app.coderabbit.ai/login.

Comment @coderabbitai help to get the list of available commands and usage tips.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant