🛡️ Sentinel: Fix potential XSS in Health Check page by AGI-Corporation · Pull Request #38 · AGI-Corporation/Route.X

AGI-Corporation · 2026-04-05T07:52:14Z

Refactored the Health Check page to remove the use of dangerouslySetInnerHTML. System metadata for version and websocket checks is now rendered using safe React JSX fragments instead of raw HTML strings. Added rel="noreferrer" to external links for improved security. Also added a security learning entry in .jules/sentinel.md.

PR created automatically by Jules for task 4190290139442982079 started by @AGI-Corporation

Summary by CodeRabbit

Bug Fixes
- Enhanced security in the health check status display by preventing potential cross-site scripting vulnerabilities when rendering system information.

Refactored the Health Check page to remove the use of `dangerouslySetInnerHTML`. System metadata for version and websocket checks is now rendered using safe React JSX fragments instead of raw HTML strings. Added rel="noreferrer" to external links for improved security. Severity: MEDIUM Vulnerability: Potential XSS via dangerouslySetInnerHTML. Impact: Possible script execution if metadata is compromised. Fix: Use React nodes for dynamic content rendering. Verification: ESLint and tsc passed; manual verification of the file content. Co-authored-by: AGI-Corporation <186229839+AGI-Corporation@users.noreply.github.com>

google-labs-jules · 2026-04-05T07:52:16Z

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

For security, I will only act on instructions from the user who triggered this task.

coderabbitai · 2026-04-05T07:52:35Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: d13029bd-3731-46a9-8668-20a308b1b574

📥 Commits

Reviewing files that changed from the base of the PR and between f61e720 and 1f52fe2.

📒 Files selected for processing (2)

.jules/sentinel.md
packages/react-ui/src/app/routes/platform/infra/health/index.tsx

📝 Walkthrough

Walkthrough

The changes implement XSS mitigation by replacing HTML string assembly and dangerouslySetInnerHTML with React JSX rendering in a health check component. A sentinel entry documents this security finding and prevention approach.

Changes

Cohort / File(s)	Summary
Security Documentation `.jules/sentinel.md`	Added sentinel record documenting XSS vulnerability finding related to `dangerouslySetInnerHTML` usage in health check details rendering, with prevention rule to use React nodes/JSX instead of string-based HTML.
Health Check Component Refactor `packages/react-ui/src/app/routes/platform/infra/health/index.tsx`	Replaced HTML string assembly and `dangerouslySetInnerHTML` with JSX rendering for version and WebSocket check details. Updated version check to conditionally render "Current"/"Latest" values and upgrade block via JSX. Updated WebSocket check to conditionally render either translated "No issues detected" string or JSX block with line breaks and hyperlink. Modified DataTable "Details" cell to render directly without `dangerouslySetInnerHTML`. Hyperlink now uses `className` and includes `rel="noreferrer"`.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Poem

🐰 No more dangerous HTML strings,
Just JSX in our React wings!
XSS threats now at bay,
Safe rendering saves the day! ✨

🚥 Pre-merge checks | ✅ 1 | ❌ 2

❌ Failed checks (1 warning, 1 inconclusive)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.
Description check	❓ Inconclusive	The description covers the core changes but doesn't fully match the template structure, missing detailed sections on feature explanation and user scenarios.	Expand description to include 'Explain How the Feature Works' and 'Relevant User Scenarios' sections, or clarify why this security fix doesn't require those sections per the template.

✅ Passed checks (1 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the main change: fixing a potential XSS vulnerability in the Health Check page by removing dangerouslySetInnerHTML usage.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch sentinel/fix-xss-health-check-4190290139442982079

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Copilot

Pull request overview

This PR hardens the Platform → Infra → Health page against XSS by eliminating HTML-string rendering and switching to safe JSX/React node rendering for the “details” column.

Changes:

Replaced dangerouslySetInnerHTML usage with JSX fragments/React nodes for version and WebSocket health details.
Added rel="noreferrer" on external links opened in a new tab.
Added a security learning entry documenting the XSS mitigation.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
packages/react-ui/src/app/routes/platform/infra/health/index.tsx	Renders health check “details” as React nodes instead of HTML strings to remove an XSS vector; updates external link attributes.
.jules/sentinel.md	Documents the XSS lesson/prevention guidance for future reference.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-05T07:54:15Z

packages/react-ui/src/app/routes/platform/infra/health/index.tsx

+              <a
+                className="font-medium text-blue-600 dark:text-blue-500 hover:underline"
+                href="https://github.com/activepieces/activepieces/releases"
+                target="_blank"
+                rel="noreferrer"
+              >


For external links opened with target="_blank", consider using rel="noopener noreferrer" (not just noreferrer) to prevent reverse-tabnabbing in older/edge browser implementations and to match the existing pattern used elsewhere in the UI (e.g. help-and-feedback.tsx).

Copilot · 2026-04-05T07:54:16Z

packages/react-ui/src/app/routes/platform/infra/health/index.tsx

+          <a
+            className="font-medium text-blue-600 dark:text-blue-500 hover:underline"
+            href="https://www.activepieces.com/docs/install/configuration/troubleshooting"
+            target="_blank"
+            rel="noreferrer"
+          >


Same as above: when using target="_blank", it’s safer and more consistent to set rel="noopener noreferrer" rather than only noreferrer.

Refactored the Health Check page to remove the use of `dangerouslySetInnerHTML`. System metadata for version and websocket checks is now rendered using safe React JSX fragments instead of raw HTML strings. Added rel="noreferrer" to external links for improved security. Fixes #1 Severity: MEDIUM Vulnerability: Potential XSS via dangerouslySetInnerHTML. Impact: Possible script execution if metadata is compromised. Fix: Use React nodes for dynamic content rendering. Verification: ESLint and tsc passed; manual verification of the file content. Co-authored-by: AGI-Corporation <186229839+AGI-Corporation@users.noreply.github.com>

Copilot AI review requested due to automatic review settings April 5, 2026 07:52

Copilot started reviewing on behalf of AGI-Corporation April 5, 2026 07:52 View session

Copilot AI reviewed Apr 5, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

🛡️ Sentinel: Fix potential XSS in Health Check page#38

🛡️ Sentinel: Fix potential XSS in Health Check page#38
AGI-Corporation wants to merge 2 commits intomainfrom
sentinel/fix-xss-health-check-4190290139442982079

AGI-Corporation commented Apr 5, 2026 •

edited by coderabbitai bot

Loading

Uh oh!

google-labs-jules bot commented Apr 5, 2026

Uh oh!

coderabbitai bot commented Apr 5, 2026 •

edited

Loading

Walkthrough

Changes

Estimated code review effort

Poem

❌ Failed checks (1 warning, 1 inconclusive)

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Apr 5, 2026

Uh oh!

Copilot AI Apr 5, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

AGI-Corporation commented Apr 5, 2026 • edited by coderabbitai bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

google-labs-jules bot commented Apr 5, 2026

Uh oh!

coderabbitai bot commented Apr 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Poem

❌ Failed checks (1 warning, 1 inconclusive)

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Apr 5, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 5, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

AGI-Corporation commented Apr 5, 2026 •

edited by coderabbitai bot

Loading

coderabbitai bot commented Apr 5, 2026 •

edited

Loading