source-academy / frontend

Frontend of Source Academy, an online experiential environment for computational thinking (React, Redux, Saga, Blueprint)
https://sourceacademy.org
Apache License 2.0
103 stars 167 forks source link

Use `DOMPurify` to sanitize and mitigate XSS attacks #3049

Closed TheMythologist closed 2 months ago

TheMythologist commented 2 months ago

Description

An XSS vulnerability is present in the Markdown component, where unsanitized user input is directly passed into dangerouslySetInnerHTML. For more info, refer to here.

Note: The changes in UI test snapshots are merely the order of the a tag attributes - they are essentially the same.

Type of change

How to test

An example would be entering the text <img src="" onerror={alert('xss')} /> in the "Module Help Text" of the Admin Panel page when creating a new course. After sanitization, the alert('xss') command should not be run.

Checklist

coveralls commented 2 months ago

Pull Request Test Coverage Report for Build 11007895846

Details


Totals Coverage Status
Change from base Build 10982558647: 0.0%
Covered Lines: 4852
Relevant Lines: 14547

💛 - Coveralls