Added DOMPurify library to sanitize HTML content before rendering with dangerouslySetInnerHTML. This prevents Cross-Site Scripting (XSS) attacks where malicious scripts could be injected through blog post content. Changes: - Installed dompurify and @types/dompurify - Added HTML sanitization in BlogPost.tsx (client/pages/BlogPost.tsx:139) - Added HTML sanitization in AdminBlogEditor.tsx preview (client/components/admin/AdminBlogEditor.tsx:273) Security impact: HIGH - Previously, unsanitized HTML from the API could execute arbitrary JavaScript, potentially stealing user credentials or performing unauthorized actions. |
||
|---|---|---|
| .. | ||
| api | ||
| components | ||
| contexts | ||
| data | ||
| desktop | ||
| hooks | ||
| lib | ||
| pages | ||
| App.tsx | ||
| desktop-main.html | ||
| desktop-overlay.html | ||
| global.css | ||
| main.tsx | ||
| vite-env.d.ts | ||