From 91e305e39da2a5af785fe8371f7ed8871314fdcf Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Mon, 5 Oct 2026 10:46:16 +0000
Subject: [PATCH] Fix XSS vulnerability in email preview by replacing
 dangerouslySetInnerHTML with a sandboxed iframe

Co-authored-by: brycejohnson1417 <257422776+brycejohnson1417@users.noreply.github.com>
---
 components/accounts/ppp-savings-panel.tsx | 30 ++++++++++++++++++++++-
 1 file changed, 29 insertions(+), 1 deletion(-)

diff --git a/components/accounts/ppp-savings-panel.tsx b/components/accounts/ppp-savings-panel.tsx
index e6d961b..d75c210 100644
--- a/components/accounts/ppp-savings-panel.tsx
+++ b/components/accounts/ppp-savings-panel.tsx
@@ -42,6 +42,29 @@ export function PppSavingsPanel({ orgSlug, accountId }: PppSavingsPanelProps) {
     return `mailto:${encodeURIComponent(report.recipientEmail)}?subject=${encodeURIComponent(report.email.subject)}&body=${encodeURIComponent(draft)}`;
   }, [draft, report]);
   const sanitizedEmailHtml = useMemo(() => (report?.email.html ? DOMPurify.sanitize(report.email.html) : ""), [report]);
+  const iframeSrcDoc = useMemo(
+    () => `
+      <!DOCTYPE html>
+      <html>
+        <head>
+          <style>
+            body {
+              margin: 0;
+              padding: 0;
+              font-family: ui-sans-serif, system-ui, sans-serif;
+              font-size: 14px;
+              color: black;
+              background-color: white;
+            }
+          </style>
+        </head>
+        <body>
+          ${sanitizedEmailHtml}
+        </body>
+      </html>
+    `,
+    [sanitizedEmailHtml]
+  );
 
   const pdfHref = report ? `/api/runtime/organizations/${orgSlug}/accounts/${accountId}/ppp-savings/pdf?year=${report.year}` : null;
 
@@ -233,7 +256,12 @@ export function PppSavingsPanel({ orgSlug, accountId }: PppSavingsPanelProps) {
               </div>
             </div>
             <div className="min-h-[24rem] w-full overflow-auto bg-white p-6 text-sm text-black">
-              <div dangerouslySetInnerHTML={{ __html: sanitizedEmailHtml }} />
+              <iframe
+                title="Email Preview"
+                srcDoc={iframeSrcDoc}
+                sandbox="allow-popups allow-popups-to-escape-sandbox"
+                className="h-[24rem] w-full border-none bg-transparent"
+              />
             </div>
           </div>
         </div>