2026 06 10 Security XSS ItemToString

Security: XSS Vulnerability in itemToString

Category: Security - XSS (Cross-Site Scripting) Effort: Medium Priority: High Component: frontend/src/components/waste/WasteSearch/WasteSearchFiltersAdvanced/AdvancedFilterClientInput/index.tsx

---

Description

The AutoCompleteInput component uses itemToString={(item) => item!.description} to render items. If the description field from the backend contains malicious HTML or JavaScript (e.g., <script>alert('xss')</script>), and if Carbon's AutoCompleteInput renders this as raw HTML rather than escaped text, this could lead to stored XSS attacks.

Attack vector:

1. Malicious user or compromised backend stores a CodeDescriptionDto with a description containing script tags
2. When this item is rendered in the autocomplete dropdown, the script executes in the context of the victim's session

---

Suggested Fix

Option 1: Sanitize at Render Time (Recommended)

import DOMPurify from 'dompurify';

// In the AutoCompleteInput props:
itemToString={(item) => DOMPurify.sanitize(item!.description)}

Option 2: Escape HTML Entities

itemToString={(item) => {
  const desc = item!.description
    .replace(/&/g, '&')
    .replace(/</g, '&lt;')
    .replace(/>/g, '&gt;')
    .replace(/"/g, '&quot;')
    .replace(/'/g, '&#x27;');
  return desc;
}}

Option 3: Sanitize at API Response Level (Best for systemic fix)

Ensure forestClientAutocompleteResult2CodeDescription sanitizes the description field before it reaches the component.

---

Related Files

• frontend/src/components/waste/WasteSearch/WasteSearchFiltersAdvanced/AdvancedFilterClientInput/index.tsx
• frontend/src/services/utils.ts (check forestClientAutocompleteResult2CodeDescription)
• Backend API: forestclient.searchForestClients endpoint

Dependencies

• May require adding dompurify package: npm install dompurify

Testing

• Verify that <script> tags in descriptions are rendered as text, not executed
• Test with special characters (<, >, &, ", ') to ensure proper escaping