Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Hi, I've discovered a stored Cross-Site Scripting (XSS) vulnerability in your GitHub repository:
Vulnerability Details:
.
Version Affected: All versions
Severity: [High/Critical – Stored XSS can have a significant impact. Adjust based on your assessment]
Description: The vulnerability allows malicious attacks to inject scripts through a direct network request. Once embedded, any user viewing the story list or the specific story's details will execute the malicious script.
Steps to Reproduce:
Send a direct network request (bypassing the user interface) to /api/user/create with a payload content containing the malicious script:
After the blog is successfully created, any user who views the blog list or the specific blog’s details will run the malicious script.
Suggested Fix or Mitigation:
Server-side: Within the /create controller, it's essential to sanitize the user's input (content) before processing it to ensure malicious scripts are neutralized.
Client-side: Prior to displaying the story's content using dangerouslySetInnerHtml, ensure that the content is sanitized using tools like DOMPurify to avert script execution.