From 5db456e3e2a6bef67f1d751f281f3e10aa9fa2bf Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Thu, 2 Jul 2026 10:26:00 +0000
Subject: [PATCH] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20[HIGH]=20Fi?=
 =?UTF-8?q?x=20XSS=20vulnerability=20in=20email=20preview?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-authored-by: brycejohnson1417 <257422776+brycejohnson1417@users.noreply.github.com>
---
 .jules/sentinel.md                        | 5 +++++
 components/accounts/ppp-savings-panel.tsx | 9 +++++++--
 package-lock.json                         | 1 -
 3 files changed, 12 insertions(+), 3 deletions(-)
 create mode 100644 .jules/sentinel.md

diff --git a/.jules/sentinel.md b/.jules/sentinel.md
new file mode 100644
index 0000000..6e9974e
--- /dev/null
+++ b/.jules/sentinel.md
@@ -0,0 +1,5 @@
+## 2024-07-02 - Replace dangerouslySetInnerHTML with Iframe
+
+**Vulnerability:** Used `dangerouslySetInnerHTML` for rendering email HTML previews, even with DOMPurify.
+**Learning:** `dangerouslySetInnerHTML` can still be a risk if DOMPurify fails to catch an edge-case bypass. Iframes provide a robust, defense-in-depth sandbox context that completely blocks script execution when `allow-scripts` is omitted from the `sandbox` attribute. Also learned that Tailwind classes on the iframe element do not apply to the `srcDoc` content, requiring an inline `<style>` tag in the `srcDoc` itself.
+**Prevention:** For untrusted or dynamic HTML, prefer `<iframe srcDoc="..." sandbox="...">` over `dangerouslySetInnerHTML`.
\ No newline at end of file
diff --git a/components/accounts/ppp-savings-panel.tsx b/components/accounts/ppp-savings-panel.tsx
index e6d961b..e213722 100644
--- a/components/accounts/ppp-savings-panel.tsx
+++ b/components/accounts/ppp-savings-panel.tsx
@@ -232,8 +232,13 @@ export function PppSavingsPanel({ orgSlug, accountId }: PppSavingsPanelProps) {
                 )}
               </div>
             </div>
-            <div className="min-h-[24rem] w-full overflow-auto bg-white p-6 text-sm text-black">
-              <div dangerouslySetInnerHTML={{ __html: sanitizedEmailHtml }} />
+            <div className="min-h-[24rem] w-full overflow-hidden bg-white">
+              <iframe
+                title="Email Preview"
+                srcDoc={`<style>body { margin: 0; padding: 1.5rem; font-family: sans-serif; font-size: 0.875rem; color: black; background-color: white; }</style>${sanitizedEmailHtml}`}
+                sandbox="allow-popups allow-popups-to-escape-sandbox"
+                className="h-full min-h-[24rem] w-full border-none"
+              />
             </div>
           </div>
         </div>
diff --git a/package-lock.json b/package-lock.json
index 6115437..cfe04eb 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -4513,7 +4513,6 @@
       "version": "2.3.2",
       "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.2.tgz",
       "integrity": "sha512-xiqMQR4xAeHTuB9uWm+fFRcIOgKBMiOBP+eXiyT7jsgVCq1bkVygt00oASowB7EdtpOHaaPgKt812P9ab+DDKA==",
-      "dev": true,
       "hasInstallScript": true,
       "license": "MIT",
       "optional": true,