From 42fe855ffaa31091e39e833b4ded8711d04cb249 Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Thu, 1 Oct 2026 10:26:05 +0000
Subject: [PATCH] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20[HIGH]=20Fi?=
 =?UTF-8?q?x=20XSS=20Risk=20in=20Email=20Preview?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Replaced dangerouslySetInnerHTML with a sandboxed iframe using srcDoc
to provide defense-in-depth against XSS vulnerabilities when rendering
email previews. Added inline styles to preserve typography and restricted
sandbox permissions to allow popups (links) but block scripts.

Co-authored-by: brycejohnson1417 <257422776+brycejohnson1417@users.noreply.github.com>
---
 .jules/sentinel.md                        |  4 ++++
 components/accounts/ppp-savings-panel.tsx | 28 +++++++++++++++++++++--
 2 files changed, 30 insertions(+), 2 deletions(-)
 create mode 100644 .jules/sentinel.md

diff --git a/.jules/sentinel.md b/.jules/sentinel.md
new file mode 100644
index 0000000..df778cc
--- /dev/null
+++ b/.jules/sentinel.md
@@ -0,0 +1,4 @@
+## 2024-10-01 - [Sandboxing Email Previews]
+**Vulnerability:** XSS risk from rendering untrusted HTML via `dangerouslySetInnerHTML`, even with DOMPurify.
+**Learning:** Using a sandboxed `<iframe>` with `srcDoc` and `sandbox="allow-popups allow-popups-to-escape-sandbox"` provides a stronger, isolated browsing context that prevents script execution while preserving safe link functionality.
+**Prevention:** Prioritize sandboxed iframes for rendering dynamic HTML like email previews, and manually inject necessary CSS into the `srcDoc`.
\ No newline at end of file
diff --git a/components/accounts/ppp-savings-panel.tsx b/components/accounts/ppp-savings-panel.tsx
index e6d961b..2f389ad 100644
--- a/components/accounts/ppp-savings-panel.tsx
+++ b/components/accounts/ppp-savings-panel.tsx
@@ -232,8 +232,32 @@ export function PppSavingsPanel({ orgSlug, accountId }: PppSavingsPanelProps) {
                 )}
               </div>
             </div>
-            <div className="min-h-[24rem] w-full overflow-auto bg-white p-6 text-sm text-black">
-              <div dangerouslySetInnerHTML={{ __html: sanitizedEmailHtml }} />
+            <div className="min-h-[24rem] w-full overflow-hidden bg-white">
+              <iframe
+                title="Email Preview"
+                srcDoc={`
+                  <!DOCTYPE html>
+                  <html>
+                    <head>
+                      <style>
+                        body {
+                          font-family: ui-sans-serif, system-ui, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol", "Noto Color Emoji";
+                          font-size: 0.875rem; /* text-sm */
+                          line-height: 1.25rem;
+                          color: #000; /* text-black */
+                          margin: 0;
+                          padding: 1.5rem; /* p-6 */
+                        }
+                      </style>
+                    </head>
+                    <body>
+                      ${sanitizedEmailHtml}
+                    </body>
+                  </html>
+                `}
+                sandbox="allow-popups allow-popups-to-escape-sandbox"
+                className="h-full min-h-[24rem] w-full border-none"
+              />
             </div>
           </div>
         </div>