Potential fix for code scanning alert no. 1: Incomplete multi-character sanitization

[scorpion7slayer]

Potential fix for https://github.com/scorpion7slayer/NxtGit/security/code-scanning/1

General approach: avoid custom regex-based HTML stripping and instead use a well-tested sanitizer (DOMPurify) to convert the description to plain text, ensuring no residual tag fragments (like <script) remain. DOMPurify can be configured to return a string where all markup is removed but text content is preserved.

Best concrete fix here: replace entry.description.replace(/<[^>]*>/g, '') with a DOMPurify call that produces plain text, then truncate that. Since DOMPurify is already imported at the top of AppChangelog.tsx, we don’t need new imports. A suitable option is DOMPurify.sanitize(entry.description, { ALLOWED_TAGS: [], ALLOWED_ATTR: [] }), which strips all HTML tags and attributes, leaving only text. We then apply .substring(0, 200) to this sanitized text, just as before.

Change location: in src/components/AppChangelog.tsx, around line 198–201 where entry.description is rendered. Only that expression needs to be replaced; no extra helpers or methods are strictly required. Functionality remains the same (show up to 200 characters of description text), but we now rely on DOMPurify instead of a brittle regex.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Overview

This PR correctly addresses the GitHub code scanning alert about incomplete multi-character sanitization. The change replaces the manual regex-based HTML stripping (entry.description.replace(/<[^>]*>/g, '')) with DOMPurify, a well-established security library designed specifically for XSS prevention.

Severity	Count
CRITICAL	0
WARNING	0
SUGGESTION	0

Security Analysis

• ✅ DOMPurify is properly installed as a dependency (dompurify: ^3.3.2)
• ✅ DOMPurify is already imported in the file (line 2)
• ✅ Configuration { ALLOWED_TAGS: [], ALLOWED_ATTR: [] } correctly strips all HTML while preserving text content
• ✅ The behavior remains functionally equivalent (truncating to 200 characters)
• ✅ This is a security improvement over the previous regex approach which had edge cases

Files Reviewed (1 file)

• src/components/AppChangelog.tsx - Security fix verified