fix(web): repair 6 dead internal links + harden forum markdown against stored XSS

Routing: footer "Explorer"/"Validators" pointed to non-existent /network (4 spots
in AppLayout + LandingPageDesktop) and Explorer/Forum quick-links pointed to bare
/governance (no route) -> all hit the 404 catch-all. Repointed to /explorer and
/governance/assembly; footer "Vote" /-> /elections.

Security (stored XSS): DiscussionThread.parseMarkdown did regex->HTML then
dangerouslySetInnerHTML with no escaping/sanitizer, so <img onerror>/javascript:
links in user comments executed. Now escape HTML first, then DOMPurify-sanitize the
output to a safe tag/attr allow-list with http(s)-only hrefs.
This commit is contained in:
2026-07-24 22:43:30 -07:00
parent 0651b80eb7
commit 686eecc09e
5 changed files with 27 additions and 11 deletions
+4 -4
View File
@@ -659,9 +659,9 @@ const AppLayout: React.FC = () => {
<div className="lp-foot-col">
<h5>{t('landing.footer.network')}</h5>
<ul>
<li><a href="/network">{t('landing.footer.explorer')}</a></li>
<li><a href="/explorer">{t('landing.footer.explorer')}</a></li>
<li><a href="/telemetry">{t('landing.footer.telemetry')}</a></li>
<li><a href="/network">{t('landing.footer.validators')}</a></li>
<li><a href="/explorer">{t('landing.footer.validators')}</a></li>
<li><a href="/faucet">{t('landing.footer.faucet')}</a></li>
</ul>
</div>
@@ -670,7 +670,7 @@ const AppLayout: React.FC = () => {
<ul>
<li><a href="/wallet">{t('landing.footer.wallet')}</a></li>
<li><a href="/p2p">{t('landing.footer.trade')}</a></li>
<li><a href="/">{t('landing.footer.vote')}</a></li>
<li><a href="/elections">{t('landing.footer.vote')}</a></li>
<li><a href="/grants">{t('landing.footer.grants')}</a></li>
</ul>
</div>
@@ -689,7 +689,7 @@ const AppLayout: React.FC = () => {
<li><a href="/forum">{t('landing.footer.forum')}</a></li>
<li><a href="https://discord.gg/pezkuwichain" target="_blank" rel="noopener noreferrer">{t('landing.footer.discord')}</a></li>
<li><a href="https://t.me/PezkuwiApp" target="_blank" rel="noopener noreferrer">{t('landing.footer.telegram')}</a></li>
<li><a href="https://x.com/PezkuwiChain" target="_blank" rel="noopener noreferrer">{t('landing.footer.twitter')}</a></li>
<li><a href="https://x.com/bizinikiwi" target="_blank" rel="noopener noreferrer">{t('landing.footer.twitter')}</a></li>
</ul>
</div>
</div>