Unsafe use of innerHTML and inadequate HTML sanitization

[geeknik]

Security Incident Report

Executive Summary

This report outlines multiple security vulnerabilities found in the Primal Web App repository. The issues are primarily related to Cross-Site Scripting (XSS) vulnerabilities due to the unsafe use of innerHTML and inadequate HTML sanitization.

---

Detailed Findings

1. HIGH: Dangerous dynamic HTML insert detected. [CWE-79]

   • File: primal-web-app/src/components/Toaster/Toaster.tsx
   • Line: 21
   • Code: toaster.innerHTML = message;
   • Recommendation: Use React's JSX to dynamically insert content, which automatically escapes HTML.

   // Replace
   toaster.innerHTML = message;
   // With
   toaster.textContent = message;
   

2. HIGH: Dangerous dynamic HTML insert detected. [CWE-79]

   • File: primal-web-app/src/pages/EditProfile.tsx
   • Line: 72
   • Code: banner.innerHTML = <div class="${styles.bannerPlaceholder}"></div>;
   • Recommendation: Use React's JSX to create the banner.

   // Replace
   banner.innerHTML = `<div class="${styles.bannerPlaceholder}"></div>`;
   // With
   const bannerElement = <div className={styles.bannerPlaceholder}></div>;
   

3. HIGH: Dangerous dynamic HTML insert detected. [CWE-79]

   • File: primal-web-app/src/pages/Profile.tsx
   • Line: 144
   • Code: banner.innerHTML = <div class="${styles.bannerPlaceholder}"></div>;
   • Recommendation: Similar to the above, use React's JSX.

   // Replace
   banner.innerHTML = `<div class="${styles.bannerPlaceholder}"></div>`;
   // With
   const bannerElement = <div className={styles.bannerPlaceholder}></div>;
   

4. MEDIUM: Manual HTML sanitization detected. [CWE-79]

   • File: primal-web-app/src/lib/notes.tsx
   • Line: 25
   • Code: return html.replaceAll('<', '&lt;').replaceAll('>', '&gt;');
   • Recommendation: Use a well-tested library for HTML sanitization like DOMPurify.

   import DOMPurify from "dompurify";
   // Replace
   return html.replaceAll('<', '&lt;').replaceAll('>', '&gt;');
   // With
   return DOMPurify.sanitize(html);
   

Conclusion

The identified vulnerabilities should be addressed immediately to prevent potential security incidents. Adopting best practices for HTML sanitization and secure coding can mitigate these risks. 🤙🏻