Skip to content

[Precogs Alert] Cross-Site Scripting (XSS) detected (CWE-79, Risk: Critical) #31

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
sameer6pre wants to merge 1 commit into
base: Precogs-fix-wio3jzc0
Choose a base branch
from
Open

[Precogs Alert] Cross-Site Scripting (XSS) detected (CWE-79, Risk: Critical) #31

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 14 additions & 10 deletions orbit-app/src/components/CommentsSection.jsx
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,8 @@
import React, { useState, useEffect } from 'react';
import axios from 'axios';
import { BASE_URL } from '../util';
// FIX: Import a robust HTML sanitizer
import DOMPurify from 'dompurify';

function CommentsSection() {
const [comment, setComment] = useState('');
Expand Down Expand Up @@ -31,24 +33,26 @@ function CommentsSection() {
};

return (
<div>
<h2>Comments</h2>
<form onSubmit={handleSubmit}>
<textarea
&lt;div>
&lt;h2>Comments&lt;/h2>
&lt;form onSubmit={handleSubmit}>
&lt;textarea
value={comment}
onChange={(e) => setComment(e.target.value)}
placeholder="Write your comment here..."
/>
<button type="submit">Submit</button>
</form>
&lt;button type="submit">Submit&lt;/button>
&lt;/form>

<div className="comments-list">
&lt;div className="comments-list">
{/* FIX: Sanitize comment HTML before rendering */}
{commentsList.map((cmt, index) => (
<div key={index} dangerouslySetInnerHTML={{ __html: cmt.comment }} />
&lt;div key={index} dangerouslySetInnerHTML={{ __html: DOMPurify.sanitize(cmt.comment) }} />
))}
</div>
</div>
&lt;/div>
&lt;/div>
);
}
// FIX EXPLANATION: This fix uses DOMPurify, a well-maintained and widely used library for sanitizing HTML, to clean user-supplied comment content before injecting it into the DOM. This prevents attackers from injecting malicious scripts or HTML, effectively mitigating XSS. Ensure DOMPurify is installed (npm install dompurify) and imported as shown. This approach is robust and production-ready.

export default CommentsSection;