Fix CodeQL 'DOM reinterpreted as HTML' in HTML preview by sanitizing before parse

[scorpion7slayer]

Motivation

• CodeQL flagged a risky pattern where raw file HTML was parsed directly with DOMParser.parseFromString, which can reinterpret untrusted input as executable HTML and reintroduce XSS vectors.
• The app needs to keep interactive previews (opt-in) while preserving strong sanitization for default previews to avoid executing repository scripts in the app context.

Description

• Stop parsing raw fileContent directly; run DOMPurify.sanitize first and parse the sanitized HTML for the normal (static) preview using DOMParser.
• Add an explicitly sanitized interactive source document that allows script tags only when interactiveHtmlPreview is enabled, and use that sanitized doc for cloneInteractiveScripts so scripts are only cloned from an already-sanitized source.
• Continue to forbid inline event handler attributes and keep normal preview mode with script removed and the iframe sandboxed, with interactive mode opt-in and separately hardened.

Testing

• Ran npm run build, which completed successfully and the frontend build passed.
• Attempted cargo check --manifest-path src-tauri/Cargo.toml, which failed in this environment due to a missing system dependency (glib-2.0 / pkg-config), so full Rust validation requires CI or a host with that system package available.
• Manual inspections verified the sanitization path and that interactive cloning is gated by the sanitized interactive document.

---

Codex Task

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Overview

Severity	Count
CRITICAL	0
WARNING	0
SUGGESTION	0

Security Analysis

The PR properly addresses the CodeQL flagged XSS vulnerability:

1. Removed vulnerable code: The line const sourceDoc = new DOMParser().parseFromString(fileContent, "text/html") was parsing untrusted HTML content directly without sanitization

2. Added proper sanitization: Creates interactiveSourceDoc with DOMPurify sanitization, allowing script tags only for interactive previews

3. Defense in depth:

   • Non-interactive mode: FORBID_TAGS: ["script"] removes script tags
   • Interactive mode: Scripts allowed via ADD_TAGS, but inline event handlers (on* attributes) are still stripped by the post-processing loop at lines 1203-1209
   • CSP is applied via injectPreviewCsp()

4. Safe conditional logic: Changed from if (interactiveHtmlPreview) to if (interactiveHtmlPreview && interactiveSourceDoc) to ensure the source document exists before use

Note

The PR description mentions cargo check failed due to missing system dependencies (glib-2.0 / pkg-config). This is an environmental issue requiring CI or a host with the necessary packages, not a code issue.

Files Reviewed (1 file)

• src/components/RepoDetail.tsx - No issues