diff --git a/.jules/sentinel.md b/.jules/sentinel.md new file mode 100644 index 0000000..fddb651 --- /dev/null +++ b/.jules/sentinel.md @@ -0,0 +1,4 @@ +## 2024-07-04 - XSS Prevention via Sandboxed Iframe in Email Preview +**Vulnerability:** Email preview rendered using `dangerouslySetInnerHTML`. +**Learning:** Even with DOMPurify, rendering dynamic HTML directly into the DOM can lead to XSS or styling clashes. Using an `iframe` with `srcDoc` and a `sandbox` attribute (`allow-popups allow-popups-to-escape-sandbox`) provides true isolation without needing a separate endpoint. +**Prevention:** For untrusted or complex HTML previews, default to sandboxed iframes. Manually inject necessary styles into the `srcDoc` to ensure correct rendering. \ No newline at end of file diff --git a/components/accounts/ppp-savings-panel.tsx b/components/accounts/ppp-savings-panel.tsx index e6d961b..e7f22f2 100644 --- a/components/accounts/ppp-savings-panel.tsx +++ b/components/accounts/ppp-savings-panel.tsx @@ -232,8 +232,32 @@ export function PppSavingsPanel({ orgSlug, accountId }: PppSavingsPanelProps) { )} -
-
+
+