Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update htmlStringImgUrlConverter.js Sanetize DOM Text Interpreted As HTML #4366

Open
wants to merge 3 commits into
base: develop
Choose a base branch
from

Conversation

Shivam7-1
Copy link

Description

Sanitize HTML content using DOMPurify before returning it in richContent. This ensures safe rendering of potentially untrusted HTML, protecting against XSS attacks. The innerHTML of the first child node is sanitized before being returned, improving security.

@pwa-studio-bot
Copy link
Collaborator

Fails
🚫 A version label is required. A maintainer must add one.
🚫

No linked issue found. Please link a relevant open issue by adding the text "closes #<issue_number>" or "closes JIRA-<issue_number>" in your PR.

🚫 Missing "Verification Steps" section. Please add it back, with detail.
Messages
📖 DangerCI Failures related to missing labels/description/linked issues/etc will persist until the next push or next pr-test build run (assuming they are fixed).
📖

Access a deployed version of this PR here. Make sure to wait for the "pwa-pull-request-deploy" job to complete.

If your PR is missing information, check against the original template here. At a minimum you must have the section headers from the template and provide some information in each section.

Generated by 🚫 dangerJS against aba8b79

@Shivam7-1
Copy link
Author

Ping @glo82145 For Reviewing

@glo82145
Copy link
Collaborator

@Shivam7-1 Can you please let us know what are these PRs for? Is there any community issue or ticket for which you are creating this fix.

@Shivam7-1
Copy link
Author

Hii @glo82145 Thanks For Reviewing
This PR is a contribution to improve security by sanitizing content with dompurify to prevent potential XSS (Cross-Site Scripting) attacks. There's no specific issue or ticket for this it just a proactive step to enhance the security of the code.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants