feat: Add HTML sanitizer for XSS prevention #26
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
- Fix BannerContent type to include buttons array, position, className, style - Make core import content types from plugins (single source of truth) - Update banner plugin to use .xp-* CSS classes instead of inline styles - Add className and style props for banner and buttons - Provide minimal, functional default styles with dark mode support - Add comprehensive tests for className and style customization - Update tests to check CSS classes instead of inline styles - Add customization documentation with three use cases (Tailwind, Design System, CSS Framework)
- Add CSS customization section to plugins README - Update banner examples page with className and style props - Add customization examples for Tailwind and inline styles - Remove emoji from banner example - Link to full customization documentation
- Add lightweight HTML sanitizer utility with whitelist-based approach - Sanitize title and message fields in banner plugin - Support safe HTML tags (strong, em, a, br, span, b, i, p) - Block dangerous tags (script, iframe, object, embed, etc.) - Block event handlers and javascript:/data: URLs - Add comprehensive XSS prevention tests (52 tests) - Add banner plugin integration tests for HTML sanitization Prevents XSS attacks while allowing safe HTML formatting in banner content.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
Adds a lightweight HTML sanitizer to prevent XSS attacks in banner content (title and message fields).
Changes
Add HTML sanitizer utility (packages/plugins/src/utils/sanitize.ts)
Integrate sanitizer into banner plugin
Add comprehensive tests
Security
Prevents common XSS attack vectors:
Testing
Related
Part of the banner content types fix branch.