From 39ed43e23fd63866938ed466a68dd42321b0c444 Mon Sep 17 00:00:00 2001
From: Sameer <142401625+sameer6pre@users.noreply.github.com>
Date: Fri, 24 Oct 2025 10:33:17 +0530
Subject: [PATCH] Update orbit-app/src/components/CommentsSection.jsx in branch
 Precogs-fix-vufe5d3o

---
 orbit-app/src/components/CommentsSection.jsx | 24 ++++++++++++--------
 1 file changed, 14 insertions(+), 10 deletions(-)

diff --git a/orbit-app/src/components/CommentsSection.jsx b/orbit-app/src/components/CommentsSection.jsx
index 6fe0c21..f75f2f9 100644
--- a/orbit-app/src/components/CommentsSection.jsx
+++ b/orbit-app/src/components/CommentsSection.jsx
@@ -1,6 +1,8 @@
 import React, { useState, useEffect } from 'react';
 import axios from 'axios';
 import { BASE_URL } from '../util';
+// FIX: Import a robust HTML sanitizer
+import DOMPurify from 'dompurify';
 
 function CommentsSection() {
   const [comment, setComment] = useState('');
@@ -31,24 +33,26 @@ function CommentsSection() {
   };
 
   return (
-    <div>
-      <h2>Comments</h2>
-      <form onSubmit={handleSubmit}>
-        <textarea
+    &lt;div>
+      &lt;h2>Comments&lt;/h2>
+      &lt;form onSubmit={handleSubmit}>
+        &lt;textarea
           value={comment}
           onChange={(e) => setComment(e.target.value)}
           placeholder="Write your comment here..."
         />
-        <button type="submit">Submit</button>
-      </form>
+        &lt;button type="submit">Submit&lt;/button>
+      &lt;/form>
 
-      <div className="comments-list">
+      &lt;div className="comments-list">
+        {/* FIX: Sanitize comment HTML before rendering */}
         {commentsList.map((cmt, index) => (
-          <div key={index} dangerouslySetInnerHTML={{ __html: cmt.comment }} />
+          &lt;div key={index} dangerouslySetInnerHTML={{ __html: DOMPurify.sanitize(cmt.comment) }} />
         ))}
-      </div>
-    </div>
+      &lt;/div>
+    &lt;/div>
   );
 }
+// FIX EXPLANATION: This fix uses DOMPurify, a well-maintained and widely used library for sanitizing HTML, to clean user-supplied comment content before injecting it into the DOM. This prevents attackers from injecting malicious scripts or HTML, effectively mitigating XSS. Ensure DOMPurify is installed (npm install dompurify) and imported as shown. This approach is robust and production-ready.
 
 export default CommentsSection;