fix(preview): sandbox markdown, links, and media for prompt previews (#244) - #252
Draft
s6pa1rta3n-lab wants to merge 1 commit into
Draft
fix(preview): sandbox markdown, links, and media for prompt previews (#244)#252s6pa1rta3n-lab wants to merge 1 commit into
s6pa1rta3n-lab wants to merge 1 commit into
Conversation
…rompt-Hash-Stellar#244) - Enhance MarkdownContent component with strict rehype-sanitize schema disallowing unsafe tags - Strip dangerous raw script, iframe, embed, and object tags prior to markdown parsing - Restrict links to safe protocols (http, https, mailto) and enforce target="_blank" with rel="noopener noreferrer nofollow" - Restrict images to safe protocols, enforce lazy loading and responsive max-dimensions, and suppress tracking pixels - Prevent layout breaking by applying break-words and overflow-wrap anywhere across prompt detail and form preview containers - Enforce length budget with preview truncation indicator - Implement server-side preview and search index sanitization utility - Add comprehensive frontend and backend regression test suites
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Resolves #244 by implementing client-side and server-side preview sanitization, sandboxed markdown and media rendering, and layout constraint protections across prompt previews.
Changes
src/components/MarkdownContent.tsx):rehype-sanitizeschema disallowing unsafe tags (script,style,iframe,embed,object,form, etc.).stripDangerousRawTags) to prevent raw HTML block absorption from hiding adjacent content.javascript:,data:,vbscript:,file:) by rendering inert fallback elements.http,https,mailto) with mandatorytarget="_blank"andrel="noopener noreferrer nofollow".max-w-full,max-h-96, lazy loading (loading="lazy"), async decoding, and suppressed tracking pixels (1x1 dimensions or tracking beacon URLs).break-wordsand[overflow-wrap:anywhere]on containers to prevent horizontal overflows.PromptDetailPage.tsx,CreatePromptForm.tsx):break-words [overflow-wrap:anywhere]to preview text andoverflow-hiddento preview containers.server/src/utils/previewSanitizer.ts):sanitizePreviewTextfor stripping HTML tags, scripts, tracking beacons, and markdown images/links to construct safe plain-text preview snippets.sanitizePreviewMarkdownfor neutralizing scripts, frames, inline handlers, and unsafe protocols while preserving valid markdown formatting.sanitizePreviewTextintoindexPromptProjectioninserver/src/services/promptSearchIndex.ts.src/components/MarkdownContent.test.tsx(18 tests) covering XSS payloads, unsafe link schemes, embedded frames, tracking pixels, layout breaking text, and length limits.server/src/tests/previewSanitization.test.ts(17 tests) covering script neutralization, event handler removal, tracking pixel detection, length budgets, and search projection indexing.Verification
vite build): Succeeded without errors.Payout Routing
0xF46C9F6d70C50BF81ef3588AB523a90a594a2F89GCL6OXAMLD75BMTINA6EMRUDWK5THQUSHMYNLSNBCJAPZJHNYJTUNIBC