fix: resolve stored XSS vulnerability in peer messaging module (#1852) - #1867
fix: resolve stored XSS vulnerability in peer messaging module (#1852)#1867atul-upadhyay-7 wants to merge 1 commit into
Conversation
|
@atul-upadhyay-7 is attempting to deploy a commit to the durdana3105's projects Team on Vercel. A member of the Team first needs to authorize it. |
📝 WalkthroughWalkthroughMessage inputs are validated and sanitized before storage, rendered messages are sanitized before display, DOMPurify is upgraded, and backend middleware adds security-related HTTP response headers. ChangesMessage Security
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant Sender
participant MessageHooks
participant validateMessageContent
participant Supabase
participant MessageBubble
Sender->>MessageHooks: submit message
MessageHooks->>validateMessageContent: validate and sanitize text
validateMessageContent-->>MessageHooks: sanitized content or validation error
MessageHooks->>Supabase: insert sanitized content
Supabase-->>MessageBubble: stored message
MessageBubble->>MessageBubble: sanitize text before display
Possibly related PRs
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@backend/app.js`:
- Line 82: Remove the res.setHeader call that sets X-XSS-Protection in the
backend response setup, leaving the existing CSP protections and other response
headers unchanged.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 94d4e95a-0a52-4518-886b-19ddb4595a92
⛔ Files ignored due to path filters (1)
package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (8)
backend/app.jspackage.jsonsrc/components/chat/MessageBubble.tsxsrc/components/messages/utils.tssrc/hooks/useMessages.tssrc/hooks/useRoomChat.tssrc/hooks/useSessions.tssrc/utils/sanitize.ts
| // Additional security headers | ||
| res.setHeader("X-Content-Type-Options", "nosniff"); | ||
| res.setHeader("X-Frame-Options", "DENY"); | ||
| res.setHeader("X-XSS-Protection", "1; mode=block"); |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== repo files matching backend/app.js =="
fd -a 'app\.js$' . | sed 's#^\./##'
echo
echo "== backend/app.js outline/snippet =="
if [ -f backend/app.js ]; then
wc -l backend/app.js
cat -n backend/app.js | sed -n '60,95p'
fi
echo
echo "== header-related usages =="
rg -n "X-XSS-Protection|Content-Security-Policy|X-Frame|X-Content-Type|Referrer" backend/app.js backend || true
echo
echo "== package/security/middleware context =="
fd -a 'package.json$' . | sed 's#^\./##' | while read -r f; do
echo "--- $f"
node -e "const p=require('${f//\'/\\\'}'); console.log(JSON.stringify({name:p.name, dependencies:p.dependencies, devDependencies:p.devDependencies, scripts:p.scripts}, null, 2))" 2>/dev/null || sed -n '1,160p' "$f"
doneRepository: durdana3105/peer-learning
Length of output: 7445
🌐 Web query:
MDN X-XSS-Protection deprecated 0 XSS protection disabled
💡 Result:
The X-XSS-Protection HTTP header is deprecated and no longer recommended for use in modern web development [1][2][3][4]. The header was originally designed to control a browser-level feature known as the XSS Auditor, which attempted to detect and block reflected cross-site scripting (XSS) attacks [2][5][6]. However, this auditor was found to be unreliable, prone to bypasses, and in some instances, capable of introducing new security vulnerabilities (such as enabling cross-site information leaks or creating XSS where none existed) [2][7][8][9]. Regarding the specific configuration X-XSS-Protection: 0: - Meaning: This value explicitly disables the legacy XSS auditor [2][7][6]. - Recommendation: While the header itself is deprecated and ignored by modern browsers, many security experts recommend explicitly setting X-XSS-Protection: 0 as a defensive measure [9][5][6]. Doing so ensures that if a user visits the site with a very old browser that still includes an XSS auditor, the feature is explicitly turned off rather than defaulting to an potentially harmful enabled state [9][6]. - Alternative: Simply omitting the header is also acceptable, as modern browsers have removed the XSS auditor entirely [6][4]. In 2026, the industry-standard approach for preventing XSS is to implement a robust Content Security Policy (CSP) [3][6][4]. CSP provides much stronger and more reliable protection against XSS by restricting the sources from which scripts can be loaded and executed, rendering the legacy XSS auditor obsolete [8][6][4].
Citations:
- 1: https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-XSS-Protection
- 2: https://github.com/mdn/content/blob/main/files/en-us/web/http/reference/headers/x-xss-protection/index.md
- 3: https://link.springer.com/article/10.1007/s11280-026-01410-1
- 4: https://httpfixer.dev/changelog/http-security-headers-2026/
- 5: https://http.dev/x-xss-protection
- 6: https://gf.dev/learn/xss-protection-headers
- 7: https://www.chromium.org/developers/design-documents/xss-auditor/
- 8: HTTP X-XSS-Protection is not mandatory now (and is not recommended) mozilla/infosec.mozilla.org#124
- 9: https://security.stackexchange.com/questions/253924/is-it-better-to-disable-x-xss-protection-header-or-set-the-header-as-x-xss-prote
Remove the deprecated X-XSS-Protection header.
This non-standard header is deprecated, and modern protections are provided by your existing CSP. Remove it here, or use 0 only if the browser-support policy requires explicitly disabling legacy XSS auditors.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@backend/app.js` at line 82, Remove the res.setHeader call that sets
X-XSS-Protection in the backend response setup, leaving the existing CSP
protections and other response headers unchanged.
1 participant
Summary
This PR fixes the Stored Cross-Site Scripting (XSS) vulnerability described in #1852. The fix ensures that user-generated content in peer messaging is sanitized before storage and rendering, preventing attackers from executing arbitrary JavaScript in victims' browsers.
Problem
Messages containing malicious JavaScript payloads (e.g.,
<script>alert(document.cookie)</script>) were stored in the database and rendered in victims' browsers without proper escaping. This enables session hijacking, credential theft, and unauthorized actions.Changes
Defense-in-Depth: Input Sanitization (Before Storage)
src/utils/sanitize.ts: DOMPurify-based sanitization utility that strips all HTML tags, scripts, event handlers, and dangerous attributes from user contentsrc/hooks/useMessages.ts: AddedvalidateMessageContent()before message insertsrc/hooks/useRoomChat.ts: AddedvalidateMessageContent()before message insertsrc/hooks/useSessions.ts: AddedvalidateMessageContent()before message insertDefense-in-Depth: Output Sanitization (On Render)
src/components/chat/MessageBubble.tsx: AddedsanitizeMessageContent()on text rendersrc/components/messages/utils.ts:getMessageBody()now sanitizes message contentContent Security Policy (CSP)
backend/app.js: Added CSP HTTP header blocking inline scripts, restricting sources, and preventing clickjackingX-Content-Type-Options,X-Frame-Options,X-XSS-Protection,Referrer-PolicyDependency
dompurify+@types/dompurifyfor browser-side HTML sanitizationSecurity Architecture
The fix implements a defense-in-depth strategy:
Testing
Fixes #1852
Summary by CodeRabbit
Security
Bug Fixes