🛡️ Sentinel: Fix XSS in blog route and harden JSON-LD metadata - #67
🛡️ Sentinel: Fix XSS in blog route and harden JSON-LD metadata#67Simonc44 wants to merge 1 commit into
Conversation
- Implemented safe HTML escaping in the custom markdown-lite renderer for blog posts. - Added a shared `escapeHTML` utility in `src/lib/api.ts`. - Exported `safeJsonLd` and added `createArticleSchema` to safely handle JSON-LD metadata in routes. - Sanitized URLs in blog content to prevent `javascript:` protocol injection. - Added a security learning entry in `.jules/sentinel.md`. Co-authored-by: Simonc44 <216070312+Simonc44@users.noreply.github.com>
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
1 participant
🚨 Severity: HIGH
💡 Vulnerability: Cross-Site Scripting (XSS) in the blog route.
🎯 Impact: Malicious users could inject arbitrary HTML/JS if they could control the blog post content (e.g. through a compromised data source or if the feature were expanded to user-submitted content). Also, JSON-LD metadata was not properly escaped, posing a risk of script injection in the
<head>.🔧 Fix:
escapeHTMLutility.renderContentfunction inblog.$slug.tsxto follow an "escape first, then transform" pattern.javascript:protocol check for markdown-style links.safeJsonLdutility (previously internal to__root.tsx) for all JSON-LD metadata blocks.✅ Verification: Ran
pnpm buildand verified the blog route visually using Playwright. Checked that formatting (bold, links) still works correctly while raw HTML is safely escaped.PR created automatically by Jules for task 13161617624071314981 started by @Simonc44