This report outlines multiple security vulnerabilities found in the Primal Web App repository. The issues are primarily related to Cross-Site Scripting (XSS) vulnerabilities due to the unsafe use of innerHTML and inadequate HTML sanitization.
Detailed Findings
HIGH: Dangerous dynamic HTML insert detected. [CWE-79]
Recommendation: Use a well-tested library for HTML sanitization like DOMPurify.
import DOMPurify from "dompurify";
// Replace
return html.replaceAll('<', '<').replaceAll('>', '>');
// With
return DOMPurify.sanitize(html);
Conclusion
The identified vulnerabilities should be addressed immediately to prevent potential security incidents. Adopting best practices for HTML sanitization and secure coding can mitigate these risks. 🤙🏻
Security Incident Report
Executive Summary
This report outlines multiple security vulnerabilities found in the Primal Web App repository. The issues are primarily related to Cross-Site Scripting (XSS) vulnerabilities due to the unsafe use of
innerHTML
and inadequate HTML sanitization.Detailed Findings
HIGH: Dangerous dynamic HTML insert detected. [CWE-79]
primal-web-app/src/components/Toaster/Toaster.tsx
toaster.innerHTML = message;
HIGH: Dangerous dynamic HTML insert detected. [CWE-79]
primal-web-app/src/pages/EditProfile.tsx
banner.innerHTML = <div class="${styles.bannerPlaceholder}"></div>;
HIGH: Dangerous dynamic HTML insert detected. [CWE-79]
primal-web-app/src/pages/Profile.tsx
banner.innerHTML = <div class="${styles.bannerPlaceholder}"></div>;
MEDIUM: Manual HTML sanitization detected. [CWE-79]
primal-web-app/src/lib/notes.tsx
return html.replaceAll('<', '<').replaceAll('>', '>');
Conclusion
The identified vulnerabilities should be addressed immediately to prevent potential security incidents. Adopting best practices for HTML sanitization and secure coding can mitigate these risks. 🤙🏻