[Security] XSS vulnerability in static site export (ExportPanel.tsx)

[d-oit]

Description

The static site export in ExportPanel.tsx injects entity.description directly into HTML without escaping. Since entity.description contains HTML from the TipTap editor, a user could inject arbitrary JavaScript that executes when the exported HTML page is opened.

Vulnerable Code

File: src/features/export/ExportPanel.tsx (lines ~159-160)

if (entity.description) {
  // entity.description contains HTML from Tiptap editor.
  // We preserve it to maintain formatting in the export.
  html += `\n      <div class="description">${entity.description}</div>\n`;
}

Impact

• Severity: Critical
• Attack vector: A user creates an entity with a description containing <script> tags or event handlers (e.g., <img onerror="...">), then exports as HTML. Anyone opening the exported page executes the injected script.
• Impact: Arbitrary JavaScript execution in the context of the exported page (stealing cookies, redirecting users, defacing content).

Recommended Fix

1. Sanitize entity.description using DOMPurify before inserting into the export HTML
2. Add escapeHtml() for plain-text fields (already used for entity names/claims)
3. Add Content Security Policy headers to exported HTML
4. Add a security test case that verifies malicious HTML is stripped

Acceptance Criteria

• entity.description is sanitized via DOMPurify before HTML export
• Plain text fields use escapeHtml()
• Exported HTML includes CSP meta tag
• Security test added for XSS prevention in export

[github-actions]

👋 This looks like a duplicate of #169.

The canonical issue has broader scope and/or more tasks — please subscribe there for updates.

⏳ This issue will be auto-closed in 3 days unless you react with 👎 to dispute.

Detected via title similarity analysis