🛡️ Sentinel: [CRITICAL] Fix XSS in blog markdown parser

[google-labs-jules]

🚨 Severity: CRITICAL
💡 Vulnerability: The custom markdown parsing logic in src/app/blog/[slug]/page.tsx directly used user input for HTML string formatting without escaping characters. This allowed for both raw HTML injection (e.g. <script>) and malicious javascript: URI injections via link tags.
🎯 Impact: XSS execution on any rendered blog post, potentially leading to unauthorized actions or data exfiltration if malicious input were provided.
🔧 Fix: Added a comprehensive escapeHtml utility. Sanitized the text before replacing markdown syntax tokens, enforced escapeHtml in code blocks, and stripped javascript: protocol links in the markdown link parser.
✅ Verification: Run pnpm test and pnpm lint to verify that there are no regressions.

---

PR created automatically by Jules for task 1057208448077118796 started by @thegdsks

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Advanced

Run ID: 3fe1d0bf-6a58-4a3b-9b05-10f9316c3223

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Confidence Score: 4/5

The PR is not yet safe to merge because the link sanitizer still permits browser-normalized javascript: URLs containing embedded ASCII whitespace.

Findings

1.   Tab bypasses protocol check ▶

Summary

• Escapes HTML-sensitive characters before processing inline Markdown.
• Escapes fenced code-block contents.
• Attempts to reject javascript: links before generating anchor elements.
• Records the vulnerability and prevention guidance in the Sentinel notes.
• No code has changed since the previous review.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
    A[Post body] --> B[escapeHtml]
    B --> C[Inline Markdown replacements]
    C --> D[Link protocol check]
    D --> E[Generated HTML]
    E --> F[dangerouslySetInnerHTML]

Loading

_{Reviews (2) · Last reviewed commit: "🛡️ Sentinel: [CRITICAL] Fix XSS in blog..."}

[greptile-apps]

Tab bypasses protocol check

A Markdown URL such as [link](java\tscript:alert(document.domain)) bypasses this check because the link parser preserves the embedded tab and trim() removes only surrounding whitespace. The generated value is then placed in an anchor rendered through dangerouslySetInnerHTML. Standard URL parsing strips the tab and recognizes the javascript: scheme, so activating the link can execute script. Normalize the URL with a standards-compliant parser and allow only safe protocols instead of checking the raw prefix.

How this was verified: The unrestricted post body reaches processInline, whose tab-preserving href capture emits the unchecked value into an anchor consumed by dangerouslySetInnerHTML, while standard URL parsing recognizes it as the javascript: scheme.

Knowledge Base Used: Blog and feed publishing

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud