Issue
After reviewing the code, `dangerouslySetInnerHTML` is used in 5 locations to render problem descriptions that could come from Codeforces API, admin input, or other external sources.
Affected Files
| File |
Line |
What's Rendered |
| `src/pages/potd.tsx` |
258 |
`formatDescription(truncatedDesc)` |
| `src/pages/questions/[id].tsx` |
447-449 |
`formatDescription(ques.description)` |
| `src/pages/questions/[id].tsx` |
458-460 |
`formatDescription(ques.input_format)` |
| `src/pages/questions/[id].tsx` |
469-471 |
`formatDescription(ques.output_format)` |
| `src/components/ProblemOfTheDay.jsx` |
8 |
`formatDescription(problem.description)` |
Attack Vector
If any problem description contains HTML with event handlers or script tags (from Codeforces API, or an admin accidentally pasting HTML), it will execute in the browser:
```html

```
Fix
Install DOMPurify:
```bash
npm install dompurify @types/dompurify
```
Then sanitize before rendering:
```tsx
import DOMPurify from 'dompurify';
// Replace each:
Issue
After reviewing the code, `dangerouslySetInnerHTML` is used in 5 locations to render problem descriptions that could come from Codeforces API, admin input, or other external sources.
Affected Files
Attack Vector
If any problem description contains HTML with event handlers or script tags (from Codeforces API, or an admin accidentally pasting HTML), it will execute in the browser:
```html

```
Fix
Install DOMPurify:
```bash
npm install dompurify @types/dompurify
```
Then sanitize before rendering:
```tsx
import DOMPurify from 'dompurify';
// Replace each:
// With: