Skip to content

XSS: dangerouslySetInnerHTML renders unsanitized problem statements in 5 locations #159

@amaydixit11

Description

@amaydixit11

Issue

After reviewing the code, `dangerouslySetInnerHTML` is used in 5 locations to render problem descriptions that could come from Codeforces API, admin input, or other external sources.

Affected Files

File Line What's Rendered
`src/pages/potd.tsx` 258 `formatDescription(truncatedDesc)`
`src/pages/questions/[id].tsx` 447-449 `formatDescription(ques.description)`
`src/pages/questions/[id].tsx` 458-460 `formatDescription(ques.input_format)`
`src/pages/questions/[id].tsx` 469-471 `formatDescription(ques.output_format)`
`src/components/ProblemOfTheDay.jsx` 8 `formatDescription(problem.description)`

Attack Vector

If any problem description contains HTML with event handlers or script tags (from Codeforces API, or an admin accidentally pasting HTML), it will execute in the browser:

```html

```

Fix

Install DOMPurify:
```bash
npm install dompurify @types/dompurify
```

Then sanitize before rendering:
```tsx
import DOMPurify from 'dompurify';

// Replace each:

// With:

\`\`\`

Metadata

Metadata

Assignees

No one assigned

    Labels

    advancedComplex issues requiring experienced contributorsbugSomething isn't workingsecuritySecurity vulnerabilities

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions