From f7f3ac747c01833640da1ab3ab2715898685298a Mon Sep 17 00:00:00 2001 From: "google-labs-jules[bot]" <161369871+google-labs-jules[bot]@users.noreply.github.com> Date: Sat, 4 Jul 2026 10:57:24 +0000 Subject: [PATCH] Fix XSS vulnerability in email preview by replacing dangerouslySetInnerHTML with a sandboxed iframe Co-authored-by: brycejohnson1417 <257422776+brycejohnson1417@users.noreply.github.com> --- .jules/sentinel.md | 4 ++++ components/accounts/ppp-savings-panel.tsx | 28 +++++++++++++++++++++-- 2 files changed, 30 insertions(+), 2 deletions(-) create mode 100644 .jules/sentinel.md diff --git a/.jules/sentinel.md b/.jules/sentinel.md new file mode 100644 index 0000000..fddb651 --- /dev/null +++ b/.jules/sentinel.md @@ -0,0 +1,4 @@ +## 2024-07-04 - XSS Prevention via Sandboxed Iframe in Email Preview +**Vulnerability:** Email preview rendered using `dangerouslySetInnerHTML`. +**Learning:** Even with DOMPurify, rendering dynamic HTML directly into the DOM can lead to XSS or styling clashes. Using an `iframe` with `srcDoc` and a `sandbox` attribute (`allow-popups allow-popups-to-escape-sandbox`) provides true isolation without needing a separate endpoint. +**Prevention:** For untrusted or complex HTML previews, default to sandboxed iframes. Manually inject necessary styles into the `srcDoc` to ensure correct rendering. \ No newline at end of file diff --git a/components/accounts/ppp-savings-panel.tsx b/components/accounts/ppp-savings-panel.tsx index e6d961b..e7f22f2 100644 --- a/components/accounts/ppp-savings-panel.tsx +++ b/components/accounts/ppp-savings-panel.tsx @@ -232,8 +232,32 @@ export function PppSavingsPanel({ orgSlug, accountId }: PppSavingsPanelProps) { )} -
-
+
+