🛡️ Sentinel: [HIGH] Fix XSS vulnerability in DescriptionPreview#11
🛡️ Sentinel: [HIGH] Fix XSS vulnerability in DescriptionPreview#11
Conversation
Co-authored-by: bobdivx <6737167+bobdivx@users.noreply.github.com>
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request significantly enhances the security posture of the application by fixing a high-severity XSS vulnerability. It ensures that user-generated content displayed in the Highlights
🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console. Changelog
Activity
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request correctly addresses a high-severity Cross-Site Scripting (XSS) vulnerability by integrating isomorphic-dompurify to sanitize HTML content before rendering. The use of an allow-list for tags and attributes is a solid security practice. I've added one suggestion to further harden the fix by removing the style attribute from the allow-list and using a CSS class instead, which minimizes the attack surface. Overall, this is an excellent and crucial security improvement.
| const PREVIEW_CLASS = | ||
| 'w-full max-h-[35vh] overflow-auto rounded-lg border border-base-300 bg-base-300/80 p-4 text-sm text-base-content/90 prose prose-sm max-w-none dark:prose-invert prose-headings:my-2 prose-headings:font-semibold prose-h1:text-2xl prose-h1:sm:text-3xl prose-h1:font-bold prose-h1:tracking-tight prose-h1:mb-3 prose-h1:text-base-content prose-h2:mt-4 prose-h2:mb-2 prose-h2:pb-1 prose-h2:border-b prose-h2:border-base-content/20 prose-p:my-1 prose-pre:my-2 prose-pre:text-xs prose-pre:bg-base-200 prose-pre:rounded prose-img:max-h-48 prose-img:rounded prose-strong:text-base-content [&_.bbcode-center]:flex [&_.bbcode-center]:flex-col [&_.bbcode-center]:items-center [&_.bbcode-center_img]:block [&_.bbcode-center_img]:mx-auto [&_.popcorn-footer-logo]:max-h-6 [&_.popcorn-footer-logo]:w-auto [&_.popcorn-footer-logo]:align-middle [&_.popcorn-separator-banner]:block [&_.popcorn-separator-banner]:w-full [&_.popcorn-separator-banner]:max-h-16 [&_.popcorn-separator-banner]:min-h-[56px] [&_.popcorn-separator-banner]:object-contain [&_.popcorn-separator-banner]:my-2'; | ||
|
|
||
| /** Enlève les séquences {} résiduelles (placeholders mal rendus par le backend). */ | ||
| /** Enlève les séquences {} résiduelles (placeholders mal rendus par le backend) et assainit le HTML pour éviter le XSS. */ | ||
| function sanitizePreviewHtml(html: string): string { | ||
| return html.replace(/\{\}/g, ''); | ||
| const noPlaceholders = html.replace(/\{\}/g, ''); | ||
| return DOMPurify.sanitize(noPlaceholders, { | ||
| ALLOWED_TAGS: [ | ||
| 'b', 'i', 'u', 's', 'em', 'strong', 'a', 'p', 'br', 'hr', 'ul', 'ol', 'li', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', | ||
| 'img', 'span', 'div', 'blockquote', 'code', 'pre', 'table', 'thead', 'tbody', 'tr', 'th', 'td' | ||
| ], | ||
| ALLOWED_ATTR: ['href', 'title', 'target', 'src', 'alt', 'width', 'height', 'style', 'class'] | ||
| }); | ||
| } |
There was a problem hiding this comment.
While DOMPurify does a great job sanitizing CSS in style attributes, allowing the style attribute is generally riskier than necessary as it increases the attack surface.
The only inline style being generated by bbcodeToHtml is text-align:center for the [center] tag. This can be handled more safely using a Tailwind CSS utility class.
I suggest adding the [&_.bbcode-center]:text-center class to PREVIEW_CLASS and removing style from the list of allowed attributes in DOMPurify. This achieves the same visual result while being more secure.
| const PREVIEW_CLASS = | |
| 'w-full max-h-[35vh] overflow-auto rounded-lg border border-base-300 bg-base-300/80 p-4 text-sm text-base-content/90 prose prose-sm max-w-none dark:prose-invert prose-headings:my-2 prose-headings:font-semibold prose-h1:text-2xl prose-h1:sm:text-3xl prose-h1:font-bold prose-h1:tracking-tight prose-h1:mb-3 prose-h1:text-base-content prose-h2:mt-4 prose-h2:mb-2 prose-h2:pb-1 prose-h2:border-b prose-h2:border-base-content/20 prose-p:my-1 prose-pre:my-2 prose-pre:text-xs prose-pre:bg-base-200 prose-pre:rounded prose-img:max-h-48 prose-img:rounded prose-strong:text-base-content [&_.bbcode-center]:flex [&_.bbcode-center]:flex-col [&_.bbcode-center]:items-center [&_.bbcode-center_img]:block [&_.bbcode-center_img]:mx-auto [&_.popcorn-footer-logo]:max-h-6 [&_.popcorn-footer-logo]:w-auto [&_.popcorn-footer-logo]:align-middle [&_.popcorn-separator-banner]:block [&_.popcorn-separator-banner]:w-full [&_.popcorn-separator-banner]:max-h-16 [&_.popcorn-separator-banner]:min-h-[56px] [&_.popcorn-separator-banner]:object-contain [&_.popcorn-separator-banner]:my-2'; | |
| /** Enlève les séquences {} résiduelles (placeholders mal rendus par le backend). */ | |
| /** Enlève les séquences {} résiduelles (placeholders mal rendus par le backend) et assainit le HTML pour éviter le XSS. */ | |
| function sanitizePreviewHtml(html: string): string { | |
| return html.replace(/\{\}/g, ''); | |
| const noPlaceholders = html.replace(/\{\}/g, ''); | |
| return DOMPurify.sanitize(noPlaceholders, { | |
| ALLOWED_TAGS: [ | |
| 'b', 'i', 'u', 's', 'em', 'strong', 'a', 'p', 'br', 'hr', 'ul', 'ol', 'li', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', | |
| 'img', 'span', 'div', 'blockquote', 'code', 'pre', 'table', 'thead', 'tbody', 'tr', 'th', 'td' | |
| ], | |
| ALLOWED_ATTR: ['href', 'title', 'target', 'src', 'alt', 'width', 'height', 'style', 'class'] | |
| }); | |
| } | |
| const PREVIEW_CLASS = | |
| 'w-full max-h-[35vh] overflow-auto rounded-lg border border-base-300 bg-base-300/80 p-4 text-sm text-base-content/90 prose prose-sm max-w-none dark:prose-invert prose-headings:my-2 prose-headings:font-semibold prose-h1:text-2xl prose-h1:sm:text-3xl prose-h1:font-bold prose-h1:tracking-tight prose-h1:mb-3 prose-h1:text-base-content prose-h2:mt-4 prose-h2:mb-2 prose-h2:pb-1 prose-h2:border-b prose-h2:border-base-content/20 prose-p:my-1 prose-pre:my-2 prose-pre:text-xs prose-pre:bg-base-200 prose-pre:rounded prose-img:max-h-48 prose-img:rounded prose-strong:text-base-content [&_.bbcode-center]:flex [&_.bbcode-center]:flex-col [&_.bbcode-center]:items-center [&_.bbcode-center]:text-center [&_.bbcode-center_img]:block [&_.bbcode-center_img]:mx-auto [&_.popcorn-footer-logo]:max-h-6 [&_.popcorn-footer-logo]:w-auto [&_.popcorn-footer-logo]:align-middle [&_.popcorn-separator-banner]:block [&_.popcorn-separator-banner]:w-full [&_.popcorn-separator-banner]:max-h-16 [&_.popcorn-separator-banner]:min-h-[56px] [&_.popcorn-separator-banner]:object-contain [&_.popcorn-separator-banner]:my-2'; | |
| /** Enlève les séquences {} résiduelles (placeholders mal rendus par le backend) et assainit le HTML pour éviter le XSS. */ | |
| function sanitizePreviewHtml(html: string): string { | |
| const noPlaceholders = html.replace(/\{\}/g, ''); | |
| return DOMPurify.sanitize(noPlaceholders, { | |
| ALLOWED_TAGS: [ | |
| 'b', 'i', 'u', 's', 'em', 'strong', 'a', 'p', 'br', 'hr', 'ul', 'ol', 'li', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', | |
| 'img', 'span', 'div', 'blockquote', 'code', 'pre', 'table', 'thead', 'tbody', 'tr', 'th', 'td' | |
| ], | |
| ALLOWED_ATTR: ['href', 'title', 'target', 'src', 'alt', 'width', 'height', 'class'] | |
| }); | |
| } |
1 participant
🚨 Severity: HIGH
💡 Vulnerability: The
DescriptionPreview.tsxcomponent useddangerouslySetInnerHTMLon content received from the backend/BBCode parsing, but the customsanitizePreviewHtmlfunction only removed{}placeholders using regex. It did not actually sanitize malicious HTML tags (like<script>,<img>with onerror, etc.), exposing users to Cross-Site Scripting (XSS) attacks.🎯 Impact: An attacker could inject arbitrary JavaScript into torrent descriptions, which would then be executed in the context of the user's browser/Tauri app when they view the description, potentially leading to session hijacking, data exfiltration, or further compromise of the Tauri environment.
🔧 Fix: Installed
isomorphic-dompurifyand updatedsanitizePreviewHtmlto rigorously sanitize the HTML before rendering it, enforcing a strict allowlist of safe formatting tags and attributes.✅ Verification: Tested against standard XSS payloads; DOMPurify successfully strips malicious tags while preserving intended formatting. Code review passed and verified the safe implementation without regressions.
PR created automatically by Jules for task 3505592235441978106 started by @bobdivx