From 4b1f06fa709cf24242fd2170f584214250aa99c9 Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Mon, 6 Jul 2026 10:42:35 +0000
Subject: [PATCH] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20[HIGH]=20Fi?=
 =?UTF-8?q?x=20XSS=20vulnerability=20in=20email=20previews?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-authored-by: brycejohnson1417 <257422776+brycejohnson1417@users.noreply.github.com>
---
 .jules/sentinel.md                        |   4 +
 components/accounts/ppp-savings-panel.tsx |   9 +-
 dev_server.log                            | 160 ++++++++++++++++++++++
 3 files changed, 171 insertions(+), 2 deletions(-)
 create mode 100644 .jules/sentinel.md
 create mode 100644 dev_server.log

diff --git a/.jules/sentinel.md b/.jules/sentinel.md
new file mode 100644
index 0000000..07df5fb
--- /dev/null
+++ b/.jules/sentinel.md
@@ -0,0 +1,4 @@
+## 2024-07-06 - XSS Vulnerability in Email Previews via dangerouslySetInnerHTML
+**Vulnerability:** The `PppSavingsPanel` component uses `dangerouslySetInnerHTML` to render email previews. Even though `DOMPurify.sanitize` is used, displaying user-controlled or external HTML directly into the DOM can still pose subtle XSS risks or styling leakage, especially if `DOMPurify` configuration is not sufficiently restrictive.
+**Learning:** Using `dangerouslySetInnerHTML` combined with a sanitizer is not always sufficient for rendering complex or untrusted HTML like email templates. It is safer to isolate the rendering context entirely to prevent both XSS and CSS injection that could affect the main application layout.
+**Prevention:** Prioritize using a sandboxed `<iframe>` with the `srcDoc` attribute instead of `dangerouslySetInnerHTML` for rendering dynamic or untrusted HTML. Use `sandbox="allow-popups allow-popups-to-escape-sandbox"` to permit link clicking while omitting `allow-scripts` and `allow-same-origin`.
diff --git a/components/accounts/ppp-savings-panel.tsx b/components/accounts/ppp-savings-panel.tsx
index e6d961b..dbb72c0 100644
--- a/components/accounts/ppp-savings-panel.tsx
+++ b/components/accounts/ppp-savings-panel.tsx
@@ -232,8 +232,13 @@ export function PppSavingsPanel({ orgSlug, accountId }: PppSavingsPanelProps) {
                 )}
               </div>
             </div>
-            <div className="min-h-[24rem] w-full overflow-auto bg-white p-6 text-sm text-black">
-              <div dangerouslySetInnerHTML={{ __html: sanitizedEmailHtml }} />
+            <div className="min-h-[24rem] w-full bg-white p-0 text-sm text-black flex flex-col">
+              <iframe
+                title="Email Preview"
+                srcDoc={`<!DOCTYPE html><html><head><style>body { margin: 0; padding: 1.5rem; font-family: ui-sans-serif, system-ui, sans-serif; font-size: 0.875rem; color: #000; }</style></head><body>${sanitizedEmailHtml}</body></html>`}
+                sandbox="allow-popups allow-popups-to-escape-sandbox"
+                className="w-full flex-grow border-0"
+              />
             </div>
           </div>
         </div>
diff --git a/dev_server.log b/dev_server.log
new file mode 100644
index 0000000..0da46f3
--- /dev/null
+++ b/dev_server.log
@@ -0,0 +1,160 @@
+
+> map-app@0.1.0 dev
+> next dev
+
+▲ Next.js 16.3.0-canary.36 (Turbopack)
+- Local:         http://localhost:3000
+- Network:       http://192.168.0.2:3000
+- Environments: .env
+✓ Ready in 637ms
+Attention: Next.js now collects completely anonymous telemetry regarding usage.
+This information is used to shape Next.js' roadmap and prioritize features.
+You can learn more, including how to opt-out if you'd not like to participate in this anonymous program, by visiting the following URL:
+https://nextjs.org/telemetry
+
+
+○ Compiling / ...
+ GET / 307 in 6.7s (next.js: 6.2s, application-code: 499ms)
+ GET /login 200 in 1112ms (next.js: 872ms, application-code: 241ms)
+ GET / 307 in 206ms (next.js: 6ms, application-code: 200ms)
+ GET /login?org=fraternitees 200 in 326ms (next.js: 25ms, application-code: 301ms)
+ GET /login 200 in 209ms (next.js: 5ms, application-code: 204ms)
+○ Compiling /api/tenant-session ...
+⨯ {
+  message: 'TypeError: fetch failed',
+  details: 'TypeError: fetch failed\n' +
+    '\n' +
+    'Caused by: Error: getaddrinfo ENOTFOUND your-project-ref.supabase.co (ENOTFOUND)\n' +
+    'Error: getaddrinfo ENOTFOUND your-project-ref.supabase.co\n' +
+    '    at GetAddrInfoReqWrap.onlookupall [as oncomplete] (node:dns:122:26)\n' +
+    '    at GetAddrInfoReqWrap.callbackTrampoline (node:internal/async_hooks:130:17)',
+  hint: '',
+  code: ''
+}
+ POST /api/tenant-session 500 in 9.2s (next.js: 2.1s, application-code: 7.2s)
+⨯ Error: {"message":"TypeError: fetch failed","details":"TypeError: fetch failed\n\nCaused by: Error: getaddrinfo ENOTFOUND your-project-ref.supabase.co (ENOTFOUND)\nError: getaddrinfo ENOTFOUND your-project-ref.supabase.co\n    at GetAddrInfoReqWrap.onlookupall [as oncomplete] (node:dns:122:26)\n    at GetAddrInfoReqWrap.callbackTrampoline (node:internal/async_hooks:130:17)","hint":"","code":""}
+    at ignore-listed frames {
+  digest: '3183108395@E394'
+}
+ GET /accounts?org=fraternitees 500 in 11.4s (next.js: 3.2s, application-code: 8.3s)
+[browser] Uncaught Error: {message: ..., details: ..., hint: "", code: ...}
+⨯ TypeError: fetch failed
+    at async fetchWithRetry (lib/application/runtime/runtime-rest.ts:44:24)
+    at async runtimeRestRequest (lib/application/runtime/runtime-rest.ts:63:20)
+    at async findRuntimeOrganization (lib/application/runtime/runtime-rest.ts:128:20)
+    at async getTerritoryRuntimeDashboard (lib/application/runtime/territory-service.ts:349:24)
+    at async getRepTodaySummary (lib/application/runtime/rep-today-service.ts:58:53)
+    at async TodayPage (app/today/page.tsx:15:19)
+  42 |   for (let attempt = 1; attempt <= REST_FETCH_ATTEMPTS; attempt += 1) {
+  43 |     try {
+> 44 |       const response = await fetch(input, init);
+     |                        ^
+  45 |       if (!shouldRetryStatus(response.status) || attempt === REST_FETCH_ATTEMPTS) {
+  46 |         return response;
+  47 |       } {
+  digest: '1719308871',
+  [cause]: Error: getaddrinfo ENOTFOUND your-project-ref.supabase.co
+      at ignore-listed frames {
+    errno: -3008,
+    code: 'ENOTFOUND',
+    syscall: 'getaddrinfo',
+    hostname: 'your-project-ref.supabase.co'
+  }
+}
+ GET /today?org=fraternitees 500 in 1983ms (next.js: 995ms, application-code: 989ms)
+[browser] Uncaught TypeError: fetch failed
+    at fetchWithRetry (lib/application/runtime/runtime-rest.ts:44:24)
+    at runtimeRestRequest (lib/application/runtime/runtime-rest.ts:63:20)
+    at findRuntimeOrganization (lib/application/runtime/runtime-rest.ts:128:20)
+    at getTerritoryRuntimeDashboard (lib/application/runtime/territory-service.ts:349:24)
+    at Function.all (<anonymous>:1:21)
+    at getRepTodaySummary (lib/application/runtime/rep-today-service.ts:58:53)
+    at TodayPage (app/today/page.tsx:15:19)
+  42 |   for (let attempt = 1; attempt <= REST_FETCH_ATTEMPTS; attempt += 1) {
+  43 |     try {
+> 44 |       const response = await fetch(input, init);
+     |                        ^
+  45 |       if (!shouldRetryStatus(response.status) || attempt === REST_FETCH_ATTEMPTS) {
+  46 |         return response;
+  47 |       }
+⨯ Error: {"message":"TypeError: fetch failed","details":"TypeError: fetch failed\n\nCaused by: Error: getaddrinfo ENOTFOUND your-project-ref.supabase.co (ENOTFOUND)\nError: getaddrinfo ENOTFOUND your-project-ref.supabase.co\n    at GetAddrInfoReqWrap.onlookupall [as oncomplete] (node:dns:122:26)\n    at GetAddrInfoReqWrap.callbackTrampoline (node:internal/async_hooks:130:17)","hint":"","code":""}
+    at ignore-listed frames {
+  digest: '3183108395@E394'
+}
+ GET /accounts?org=fraternitees 500 in 7.6s (next.js: 4ms, application-code: 7.6s)
+[browser] Uncaught Error: {message: ..., details: ..., hint: "", code: ...}
+⨯ TypeError: fetch failed
+    at async fetchWithRetry (lib/application/runtime/runtime-rest.ts:44:24)
+    at async runtimeRestRequest (lib/application/runtime/runtime-rest.ts:63:20)
+    at async findRuntimeOrganization (lib/application/runtime/runtime-rest.ts:128:20)
+    at async getTerritoryRuntimeDashboard (lib/application/runtime/territory-service.ts:349:24)
+    at async getRepTodaySummary (lib/application/runtime/rep-today-service.ts:58:53)
+    at async TodayPage (app/today/page.tsx:15:19)
+  42 |   for (let attempt = 1; attempt <= REST_FETCH_ATTEMPTS; attempt += 1) {
+  43 |     try {
+> 44 |       const response = await fetch(input, init);
+     |                        ^
+  45 |       if (!shouldRetryStatus(response.status) || attempt === REST_FETCH_ATTEMPTS) {
+  46 |         return response;
+  47 |       } {
+  digest: '1719308871',
+  [cause]: Error: getaddrinfo ENOTFOUND your-project-ref.supabase.co
+      at ignore-listed frames {
+    errno: -3008,
+    code: 'ENOTFOUND',
+    syscall: 'getaddrinfo',
+    hostname: 'your-project-ref.supabase.co'
+  }
+}
+ GET /today?org=dynalites 500 in 416ms (next.js: 5ms, application-code: 412ms)
+[browser] Uncaught TypeError: fetch failed
+    at fetchWithRetry (lib/application/runtime/runtime-rest.ts:44:24)
+    at runtimeRestRequest (lib/application/runtime/runtime-rest.ts:63:20)
+    at findRuntimeOrganization (lib/application/runtime/runtime-rest.ts:128:20)
+    at getTerritoryRuntimeDashboard (lib/application/runtime/territory-service.ts:349:24)
+    at Function.all (<anonymous>:1:21)
+    at getRepTodaySummary (lib/application/runtime/rep-today-service.ts:58:53)
+    at TodayPage (app/today/page.tsx:15:19)
+  42 |   for (let attempt = 1; attempt <= REST_FETCH_ATTEMPTS; attempt += 1) {
+  43 |     try {
+> 44 |       const response = await fetch(input, init);
+     |                        ^
+  45 |       if (!shouldRetryStatus(response.status) || attempt === REST_FETCH_ATTEMPTS) {
+  46 |         return response;
+  47 |       }
+⨯ Error: {"message":"TypeError: fetch failed","details":"TypeError: fetch failed\n\nCaused by: Error: getaddrinfo ENOTFOUND your-project-ref.supabase.co (ENOTFOUND)\nError: getaddrinfo ENOTFOUND your-project-ref.supabase.co\n    at GetAddrInfoReqWrap.onlookupall [as oncomplete] (node:dns:122:26)\n    at GetAddrInfoReqWrap.callbackTrampoline (node:internal/async_hooks:130:17)","hint":"","code":""}
+    at ignore-listed frames {
+  digest: '3183108395@E394'
+}
+ GET /accounts?org=fraternitees 500 in 7.6s (next.js: 7ms, application-code: 7.6s)
+[browser] Uncaught Error: {message: ..., details: ..., hint: "", code: ...}
+⨯ Error: {"message":"TypeError: fetch failed","details":"TypeError: fetch failed\n\nCaused by: Error: getaddrinfo ENOTFOUND your-project-ref.supabase.co (ENOTFOUND)\nError: getaddrinfo ENOTFOUND your-project-ref.supabase.co\n    at GetAddrInfoReqWrap.onlookupall [as oncomplete] (node:dns:122:26)\n    at GetAddrInfoReqWrap.callbackTrampoline (node:internal/async_hooks:130:17)","hint":"","code":""}
+    at ignore-listed frames {
+  digest: '3183108395@E394'
+}
+ GET /accounts?org=fraternitees 500 in 7.7s (next.js: 3ms, application-code: 7.7s)
+[browser] Uncaught Error: {message: ..., details: ..., hint: "", code: ...}
+⨯ Error: {"message":"TypeError: fetch failed","details":"TypeError: fetch failed\n\nCaused by: Error: getaddrinfo ENOTFOUND your-project-ref.supabase.co (ENOTFOUND)\nError: getaddrinfo ENOTFOUND your-project-ref.supabase.co\n    at GetAddrInfoReqWrap.onlookupall [as oncomplete] (node:dns:122:26)\n    at GetAddrInfoReqWrap.callbackTrampoline (node:internal/async_hooks:130:17)","hint":"","code":""}
+    at ignore-listed frames {
+  digest: '3183108395@E394'
+}
+ GET /accounts?org=fraternitees 500 in 7.7s (next.js: 7ms, application-code: 7.6s)
+[browser] Uncaught Error: {message: ..., details: ..., hint: "", code: ...}
+⨯ Error: {"message":"TypeError: fetch failed","details":"TypeError: fetch failed\n\nCaused by: Error: getaddrinfo ENOTFOUND your-project-ref.supabase.co (ENOTFOUND)\nError: getaddrinfo ENOTFOUND your-project-ref.supabase.co\n    at GetAddrInfoReqWrap.onlookupall [as oncomplete] (node:dns:122:26)\n    at GetAddrInfoReqWrap.callbackTrampoline (node:internal/async_hooks:130:17)","hint":"","code":""}
+    at ignore-listed frames {
+  digest: '3183108395@E394'
+}
+ GET /territory?org=fraternitees 500 in 8.6s (next.js: 838ms, application-code: 7.8s)
+[browser] Uncaught Error: {message: ..., details: ..., hint: "", code: ...}
+⨯ Error: {"message":"TypeError: fetch failed","details":"TypeError: fetch failed\n\nCaused by: Error: getaddrinfo ENOTFOUND your-project-ref.supabase.co (ENOTFOUND)\nError: getaddrinfo ENOTFOUND your-project-ref.supabase.co\n    at GetAddrInfoReqWrap.onlookupall [as oncomplete] (node:dns:122:26)\n    at GetAddrInfoReqWrap.callbackTrampoline (node:internal/async_hooks:130:17)","hint":"","code":""}
+    at ignore-listed frames {
+  digest: '3183108395@E394'
+}
+ GET /accounts?org=fraternitees 500 in 7.6s (next.js: 4ms, application-code: 7.6s)
+[browser] Uncaught Error: {message: ..., details: ..., hint: "", code: ...}
+⨯ Error: {"message":"TypeError: fetch failed","details":"TypeError: fetch failed\n\nCaused by: Error: getaddrinfo ENOTFOUND your-project-ref.supabase.co (ENOTFOUND)\nError: getaddrinfo ENOTFOUND your-project-ref.supabase.co\n    at GetAddrInfoReqWrap.onlookupall [as oncomplete] (node:dns:122:26)\n    at GetAddrInfoReqWrap.callbackTrampoline (node:internal/async_hooks:130:17)","hint":"","code":""}
+    at ignore-listed frames {
+  digest: '3183108395@E394'
+}
+ GET /integrations?org=fraternitees 500 in 8.6s (next.js: 805ms, application-code: 7.8s)
+[browser] Uncaught Error: {message: ..., details: ..., hint: "", code: ...}