SSWConsulting / SSW.Website

Generator for ssw.com.au
https://www.ssw.com.au
Apache License 2.0
8 stars 8 forks source link

🚑 XSS - Add Input Sanitisation to User-Input Rendered Fields #1320

Closed Harry-Ross closed 1 year ago

Harry-Ross commented 1 year ago

As per my conversation with @amankumarrr, I noticed that the use of ReactDOMServer.renderToString in consulting/[filename].tsx and consulting/video-production/[filename].tsx is vulnerable to XSS attacks:

Screenshot 2023-08-30 105339

Figure: script tag input in the call to action input box

Screenshot 2023-08-30 105354

Figure: the script running on page load

### Tasks
- [ ] Locate all problematic unsanitised user input fields (i.e. that use user input in `dangerouslySetInnerHTML` or `ReactDOMServer.renderToString`
- [ ] Use the npm package [dompurify](https://www.npmjs.com/package/dompurify) or similar to sanitise user input in these fields
Harry-Ross commented 1 year ago

Update: In my investigation, I discovered that DOMPurify does not play well with Next.js's hydration strategies - as it can only run on the browser. I also tried to use isomorphic-dompurify to no avail - throws a bunch of Tina errors.

I plan to use the xss package, as it runs on both server and client.