LostRhapsody / slothtime

Minimalist time tracking website
https://slothtime.dev
GNU General Public License v3.0
0 stars 0 forks source link

Security Upgrades - Integerate DOMPurify #47

Open LostRhapsody opened 1 year ago

LostRhapsody commented 1 year ago

Because we're accepting lots of user input, we should really clean it. This can be triggered using a simple event listener any time input is detected in the usual areas, time entry table, theme modal, and upcoming notes.

How necessary is this? Probably not very. But it's nice to have.

Soon, we'll be moving to Next.JS and have some server-side operations, including storing data. It would be prudent to clean any user input before we start sending it to the server.

https://github.com/cure53/DOMPurify