pezkuwichain/pwap
1
0
Fork 0
mirror of https://github.com/pezkuwichain/pwap.git synced 2026-07-27 13:35:40 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(web): repair 6 dead internal links + harden forum markdown against stored XSS

Browse Source 
Routing: footer "Explorer"/"Validators" pointed to non-existent /network (4 spots
in AppLayout + LandingPageDesktop) and Explorer/Forum quick-links pointed to bare
/governance (no route) -> all hit the 404 catch-all. Repointed to /explorer and
/governance/assembly; footer "Vote" /-> /elections.

Security (stored XSS): DiscussionThread.parseMarkdown did regex->HTML then
dangerouslySetInnerHTML with no escaping/sanitizer, so <img onerror>/javascript:
links in user comments executed. Now escape HTML first, then DOMPurify-sanitize the
output to a safe tag/attr allow-list with http(s)-only hrefs.
This commit is contained in:
Satoshi Qazi Muhammed
2026-07-24 22:43:30 -07:00
parent 0651b80eb7
commit 686eecc09e
5 changed files with 27 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
web/src/components/forum/DiscussionThread.tsx
+17 -1
View File
@@ -9,6 +9,7 @@ import { useTranslation } from 'react-i18next';
import { DropdownMenu, DropdownMenuContent, DropdownMenuItem, DropdownMenuTrigger } from '@/components/ui/dropdown-menu';
import { useWebSocket } from '@/contexts/WebSocketContext';
import { useToast } from '@/hooks/use-toast';
import DOMPurify from 'dompurify';
interface Comment {
id: string;
@@ -329,8 +330,18 @@ export function DiscussionThread({ proposalId }: { proposalId: string }) {
</div>
);
// SECURITY: user-supplied comment content. Escape all HTML FIRST so raw markup
// (e.g. <img src=x onerror=...>) becomes inert text, THEN apply the markdown
// transforms, THEN run the result through DOMPurify restricted to a safe tag/attr
// allow-list with http(s)-only hrefs. This blocks stored XSS (script/onerror/
// javascript: URLs) while keeping basic markdown rendering.
const parseMarkdown = (text: string): string => {
return text
const escaped = (text || '')
.replace(/&/g, '&amp;')
.replace(/</g, '&lt;')
.replace(/>/g, '&gt;')
.replace(/"/g, '&quot;');
const html = escaped
.replace(/^### (.*$)/gim, '<h3>$1</h3>')
.replace(/^## (.*$)/gim, '<h2>$1</h2>')
.replace(/^# (.*$)/gim, '<h1>$1</h1>')
@@ -339,6 +350,11 @@ export function DiscussionThread({ proposalId }: { proposalId: string }) {
.replace(/\[([^\]]+)\]\(([^)]+)\)/gim, '<a href="$2" class="text-blue-600 hover:underline">$1</a>')
.replace(/^> (.*$)/gim, '<blockquote class="border-l-4 border-gray-300 pl-4 italic">$1</blockquote>')
.replace(/\n/gim, '<br>');
return DOMPurify.sanitize(html, {
ALLOWED_TAGS: ['h1', 'h2', 'h3', 'strong', 'em', 'a', 'blockquote', 'br', 'p'],
ALLOWED_ATTR: ['href', 'class'],
ALLOWED_URI_REGEXP: /^https?:\/\//i,
});
};
return (