From 75084490bcb25a4044d931107e8da8e0576c7ece Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Wed, 8 Jul 2026 10:43:55 +0000
Subject: [PATCH] Replace dangerouslySetInnerHTML with sandboxed iframe to
 prevent XSS

Replaced the `dangerouslySetInnerHTML` call in `components/accounts/ppp-savings-panel.tsx` with a properly sandboxed `iframe` using the `srcDoc` attribute to render sanitized HTML for email previews. This mitigates the risk of Cross-Site Scripting (XSS) even if DOMPurify fails to catch all payloads.

Co-authored-by: brycejohnson1417 <257422776+brycejohnson1417@users.noreply.github.com>
---
 .jules/sentinel.md                        | 4 ++++
 components/accounts/ppp-savings-panel.tsx | 6 +++++-
 2 files changed, 9 insertions(+), 1 deletion(-)
 create mode 100644 .jules/sentinel.md

diff --git a/.jules/sentinel.md b/.jules/sentinel.md
new file mode 100644
index 0000000..66ce8b1
--- /dev/null
+++ b/.jules/sentinel.md
@@ -0,0 +1,4 @@
+## 2026-07-08 - XSS Prevention via Sandboxed iframes
+**Vulnerability:** Used dangerouslySetInnerHTML for email preview rendering, presenting an XSS risk even when used with DOMPurify.
+**Learning:** To prevent XSS when rendering dynamic or untrusted HTML like email previews, an isolated browsing context is safer.
+**Prevention:** Prioritize using a sandboxed <iframe> with the srcDoc attribute instead of dangerouslySetInnerHTML. Use sandbox='allow-popups allow-popups-to-escape-sandbox' to permit link clicking while omitting allow-scripts.
diff --git a/components/accounts/ppp-savings-panel.tsx b/components/accounts/ppp-savings-panel.tsx
index e6d961b..2038841 100644
--- a/components/accounts/ppp-savings-panel.tsx
+++ b/components/accounts/ppp-savings-panel.tsx
@@ -233,7 +233,11 @@ export function PppSavingsPanel({ orgSlug, accountId }: PppSavingsPanelProps) {
               </div>
             </div>
             <div className="min-h-[24rem] w-full overflow-auto bg-white p-6 text-sm text-black">
-              <div dangerouslySetInnerHTML={{ __html: sanitizedEmailHtml }} />
+              <iframe
+                srcDoc={`<style>body { font-family: sans-serif; font-size: 14px; color: black; margin: 0; padding: 0; }</style>${sanitizedEmailHtml}`}
+                sandbox="allow-popups allow-popups-to-escape-sandbox"
+                className="h-full min-h-[24rem] w-full border-0"
+              />
             </div>
           </div>
         </div>