From e8798bb6ea9c8321a6dbb1ae27670a40096181f0 Mon Sep 17 00:00:00 2001
From: khangnghiem <56039341+khangnghiem@users.noreply.github.com>
Date: Tue, 23 Jun 2026 20:15:58 +0000
Subject: [PATCH] Fix XSS vulnerability in markdown rendering

When marked.parse parses markdown, the resulting HTML can contain malicious
script tags and attributes if the raw note is compromised. This updates
app.js to sanitize the output via DOMPurify before appending to the DOM.
It correctly falls back to escaping raw text securely if DOMPurify isn't
available.

Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
---
 .jules/sentinel.md | 4 ++++
 site/app.js        | 2 +-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/.jules/sentinel.md b/.jules/sentinel.md
index 5e0d967e..78d69e6b 100644
--- a/.jules/sentinel.md
+++ b/.jules/sentinel.md
@@ -14,3 +14,7 @@
 **Vulnerability:** Several `escapeHtml` implementations used DOM manipulation (`document.createElement('div').innerHTML`) or incomplete string replacement, failing to escape single and double quotes.
 **Learning:** Incomplete escaping allows XSS payloads to break out of HTML attributes (e.g., `<input value="${escapeHtml(userInput)}">`).
 **Prevention:** Always use `String(text)` cast combined with a comprehensive replace chain for `&`, `<`, `>`, `"`, and `'` (e.g., `&#039;`) in custom string escaping functions.
+## 2026-06-23 - Missing Sanitization in Markdown Rendering in site/app.js
+**Vulnerability:** Untrusted user input via markdown notes could be rendered into HTML and appended to the DOM via `innerHTML` without sanitization when `marked.parse` is available.
+**Learning:** Even when using a markdown parser, the resulting HTML can contain malicious script tags or attributes if the original markdown contains raw HTML. The markdown-to-HTML step is not an automatic sanitization step.
+**Prevention:** Always sanitize the resulting HTML from markdown parsers (e.g., using DOMPurify) before inserting it into the DOM via `innerHTML`.
diff --git a/site/app.js b/site/app.js
index 788bd7e7..03e6993e 100644
--- a/site/app.js
+++ b/site/app.js
@@ -2724,7 +2724,7 @@ function renderSpecsPanel() {
 
       if (typeof marked !== 'undefined') {
         const rendered = marked.parse(processedNote);
-        html += rendered;
+        html += window.DOMPurify ? window.DOMPurify.sanitize(rendered, { ADD_ATTR: ['data-note-node', 'data-node'] }) : `<pre>${processedNote.replace(/</g, '&lt;').replace(/>/g, '&gt;')}</pre>`;
       } else {
         html += `<pre>${processedNote.replace(/</g, '&lt;').replace(/>/g, '&gt;')}</pre>`;
       }