Skip to content

XSS: dangerouslySetInnerHTML renders unsanitized problem statements in 5 locations #159

Description

@amaydixit11

Issue

After reviewing the code, `dangerouslySetInnerHTML` is used in 5 locations to render problem descriptions that could come from Codeforces API, admin input, or other external sources.

Affected Files

File Line What's Rendered
`src/pages/potd.tsx` 258 `formatDescription(truncatedDesc)`
`src/pages/questions/[id].tsx` 447-449 `formatDescription(ques.description)`
`src/pages/questions/[id].tsx` 458-460 `formatDescription(ques.input_format)`
`src/pages/questions/[id].tsx` 469-471 `formatDescription(ques.output_format)`
`src/components/ProblemOfTheDay.jsx` 8 `formatDescription(problem.description)`

Attack Vector

If any problem description contains HTML with event handlers or script tags (from Codeforces API, or an admin accidentally pasting HTML), it will execute in the browser:

```html

```

Fix

Install DOMPurify:
```bash
npm install dompurify @types/dompurify
```

Then sanitize before rendering:
```tsx
import DOMPurify from 'dompurify';

// Replace each:

// With:

\`\`\`

Metadata

Metadata

Assignees

No one assigned

    Labels

    advancedComplex issues requiring experienced contributorsbugSomething isn't workingsecuritySecurity vulnerabilities

    Type

    No type

    Fields

    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions