🔒 Fix potential XSS vulnerability in BlogDetails#8
Conversation
* Added DOMPurify for HTML sanitization * Used DOMPurify.sanitize() when setting dangerouslySetInnerHTML in BlogDetails.tsx * Updated package.json and package-lock.json with dompurify dependencies Co-authored-by: Adityavanjre <66417028+Adityavanjre@users.noreply.github.com>
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Free Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (2)
📝 WalkthroughWalkthroughThis PR adds HTML content sanitization to the blog details page. DOMPurify is introduced as a runtime dependency with type definitions, and the BlogDetails component now sanitizes post content before injecting it into the DOM to prevent XSS vulnerabilities. ChangesHTML Content Sanitization with DOMPurify
🎯 2 (Simple) | ⏱️ ~10 minutes Note 🎁 Summarized by CodeRabbit FreeYour organization is on the Free plan. CodeRabbit will generate a high-level summary and a walkthrough for each pull request. For a comprehensive line-by-line review, please upgrade your subscription to CodeRabbit Pro by visiting https://app.coderabbit.ai/login. Comment |
🎯 What: This PR fixes a potential Cross-Site Scripting (XSS) vulnerability in
⚠️ Risk: Without sanitization, an attacker could potentially inject malicious scripts via the
BlogDetails.tsxwhere user-provided or backend-providedpost.contentwas being directly rendered usingdangerouslySetInnerHTML.contentfield of a blog post, leading to unauthorized actions, data theft, or session hijacking for users viewing the post.🛡️ Solution: Introduced
DOMPurify, an industry-standard HTML sanitization library, to sanitize thepost.contentbefore it is passed todangerouslySetInnerHTML. This safely strips out any malicious elements like<script>tags or inline event handlers while preserving the legitimate formatting of the blog content.PR created automatically by Jules for task 7678126869051397334 started by @Adityavanjre