diff --git a/orbit-app/src/components/CommentsSection.jsx b/orbit-app/src/components/CommentsSection.jsx
index 6fe0c21..f75f2f9 100644
--- a/orbit-app/src/components/CommentsSection.jsx
+++ b/orbit-app/src/components/CommentsSection.jsx
@@ -1,6 +1,8 @@
import React, { useState, useEffect } from 'react';
import axios from 'axios';
import { BASE_URL } from '../util';
+// FIX: Import a robust HTML sanitizer
+import DOMPurify from 'dompurify';
function CommentsSection() {
const [comment, setComment] = useState('');
@@ -31,24 +33,26 @@ function CommentsSection() {
};
return (
-
-
Comments
-
+ <button type="submit">Submit</button>
+ </form>
-
+ <div className="comments-list">
+ {/* FIX: Sanitize comment HTML before rendering */}
{commentsList.map((cmt, index) => (
-
+ <div key={index} dangerouslySetInnerHTML={{ __html: DOMPurify.sanitize(cmt.comment) }} />
))}
-
-
+ </div>
+ </div>
);
}
+// FIX EXPLANATION: This fix uses DOMPurify, a well-maintained and widely used library for sanitizing HTML, to clean user-supplied comment content before injecting it into the DOM. This prevents attackers from injecting malicious scripts or HTML, effectively mitigating XSS. Ensure DOMPurify is installed (npm install dompurify) and imported as shown. This approach is robust and production-ready.
export default CommentsSection;