mirror of
https://github.com/pezkuwichain/pwap.git
synced 2026-07-26 06:15:41 +00:00
686eecc09e
Routing: footer "Explorer"/"Validators" pointed to non-existent /network (4 spots in AppLayout + LandingPageDesktop) and Explorer/Forum quick-links pointed to bare /governance (no route) -> all hit the 404 catch-all. Repointed to /explorer and /governance/assembly; footer "Vote" /-> /elections. Security (stored XSS): DiscussionThread.parseMarkdown did regex->HTML then dangerouslySetInnerHTML with no escaping/sanitizer, so <img onerror>/javascript: links in user comments executed. Now escape HTML first, then DOMPurify-sanitize the output to a safe tag/attr allow-list with http(s)-only hrefs.