Leopoldadmin/leocrm
1
0
Fork 0
Code Issues 363 Pull Requests Actions Packages Projects Releases 1 Wiki Activity

Security fixes: P0-P2 complete (22 fixes)

Browse Source 
P0 (7): Auth-bypass removed, migrations fixed, plugin-upload disabled, RLS FORCE+WITH CHECK, plugin double-registration fixed, persistent volume, domain removed
P1 (11): User/tenant model, Redis centralized, worker separated, transactional outbox, XSS fixed, DMS chunked streaming, permissions unified, password reset, metrics secured, config/docs fixed, cross-tenant FK
P2 (4): Contact model normalized, cross-imports reduced 94%, commands+state machines for contacts/dms/mail/calendar, SPA path-traversal

8 new migrations, 99 unit tests, 13 commands, 8 contracts, 72 files changed
This commit is contained in:
Agent Zero
2026-07-25 21:03:46 +02:00
parent aaa7406929
commit 727d86614e
103 changed files with 6831 additions and 1053 deletions
Download Patch File Download Diff File Expand all files Collapse all files
frontend/src/components/comm/blocks/HtmlBlock.tsx
+2 -21
View File
@@ -1,30 +1,11 @@
import React from 'react';
import DOMPurify from 'dompurify';
import type { MessageBlock } from '@/store/commStore';
interface HtmlBlockProps {
block: MessageBlock;
}
/**
* Basic HTML sanitization: removes <script> tags and event handler attributes.
* This is a minimal sanitizer — for production use DOMPurify or similar.
*/
function sanitizeHtml(html: string): string {
let sanitized = html;
// Remove <script>...</script> blocks (including content)
sanitized = sanitized.replace(/<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi, '');
// Remove <script ...> self-referencing or incomplete tags
sanitized = sanitized.replace(/<script\b[^>]*>/gi, '');
// Remove on* event handler attributes (onclick, onload, onerror, etc.)
sanitized = sanitized.replace(/\son\w+\s*=\s*"[^"]*"/gi, '');
sanitized = sanitized.replace(/\son\w+\s*=\s*'[^']*'/gi, '');
sanitized = sanitized.replace(/\son\w+\s*=\s*[^\s>]+/gi, '');
// Remove javascript: URLs in href/src
sanitized = sanitized.replace(/(href|src)\s*=\s*"javascript:[^"]*"/gi, '$1="#"');
sanitized = sanitized.replace(/(href|src)\s*=\s*'javascript:[^']*'/gi, '$1="#"');
return sanitized;
}
const HtmlBlock: React.FC<HtmlBlockProps> = ({ block }) => {
const rawHtml: string = block.block_data.html || '';
@@ -32,7 +13,7 @@ const HtmlBlock: React.FC<HtmlBlockProps> = ({ block }) => {
return null;
}
const sanitized = sanitizeHtml(rawHtml);
const sanitized = DOMPurify.sanitize(rawHtml);
return (
<div