Task: Audit dangerouslySetInnerHTML Usage for XSS Risk #349

New issue

Open

opened 2026-02-28 00:15:35 +00:00 by jjalangtry · 0 comments

jjalangtry commented

2026-02-28 00:15:35 +00:00

(Migrated from github.com)

Audit dangerouslySetInnerHTML Usage for XSS Risk

Description

Two pages use dangerouslySetInnerHTML to render HTML content: about/primary-officers-policy/page.tsx and about/constitution/page.tsx. If the HTML source is a static string in the repo this is acceptable, but if it ever comes from the database, an API, or user input, it is a stored or reflected XSS vulnerability. This task audits the source of the HTML and adds sanitization if necessary.

Associated Epic: #346

Subtasks

Review about/primary-officers-policy/page.tsx — trace where the HTML string originates. If from a static import or hardcoded string: document as safe, add a comment. If from any dynamic source: sanitize with isomorphic-dompurify before passing to dangerouslySetInnerHTML
Review about/constitution/page.tsx — same audit as above
Search the entire codebase for additional dangerouslySetInnerHTML usage not listed above
For any dynamic HTML sources found: install isomorphic-dompurify and sanitize before render
Add a comment above each dangerouslySetInnerHTML usage explaining why it is safe (or referencing the sanitization call)

Acceptance Criteria

Every dangerouslySetInnerHTML usage in the codebase is documented as either: (a) a static/trusted source with a comment, or (b) sanitized via DOMPurify before render
No dangerouslySetInnerHTML renders content that originates from user input or a database field without sanitization

# Audit dangerouslySetInnerHTML Usage for XSS Risk ## Description Two pages use dangerouslySetInnerHTML to render HTML content: about/primary-officers-policy/page.tsx and about/constitution/page.tsx. If the HTML source is a static string in the repo this is acceptable, but if it ever comes from the database, an API, or user input, it is a stored or reflected XSS vulnerability. This task audits the source of the HTML and adds sanitization if necessary. Associated Epic: #346 ## Subtasks - [ ] Review about/primary-officers-policy/page.tsx — trace where the HTML string originates. If from a static import or hardcoded string: document as safe, add a comment. If from any dynamic source: sanitize with isomorphic-dompurify before passing to dangerouslySetInnerHTML - [ ] Review about/constitution/page.tsx — same audit as above - [ ] Search the entire codebase for additional dangerouslySetInnerHTML usage not listed above - [ ] For any dynamic HTML sources found: install isomorphic-dompurify and sanitize before render - [ ] Add a comment above each dangerouslySetInnerHTML usage explaining why it is safe (or referencing the sanitization call) ## Acceptance Criteria - [ ] Every dangerouslySetInnerHTML usage in the codebase is documented as either: (a) a static/trusted source with a comment, or (b) sanitized via DOMPurify before render - [ ] No dangerouslySetInnerHTML renders content that originates from user input or a database field without sanitization