Skip to content

Conversation

@oioki
Copy link
Member

@oioki oioki commented Jan 14, 2026

VULN-870

Removes MarkedText component usage for the SentryApp overview description, replacing it with plain text rendering.

We did not see legitimate use cases of custom CSS, only weird hacking attempts. Plain text rendering is simpler and more appropriate for this field.

@github-actions github-actions bot added the Scope: Frontend Automatically applied to PRs that change frontend components label Jan 14, 2026
Replace MarkedText with plain text rendering for the SentryApp overview description. This removes unnecessary HTML/markdown processing for the overview field while keeping feature descriptions unchanged.
@oioki oioki force-pushed the fix-sentryapp-feature-description-xss branch 3 times, most recently from 12c1a08 to 8145b65 Compare January 14, 2026 18:54
@oioki oioki changed the title fix(security): Remove dangerouslySetInnerHTML from SentryApp feature descriptions ref(ui): Remove MarkedText from SentryApp overview description Jan 14, 2026
Copy link
Member

@leeandher leeandher left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

makes sense, we didn't even advertise it as markdown friendly

Image

🚀 🔒

@oioki oioki merged commit 7645376 into master Jan 15, 2026
56 checks passed
@oioki oioki deleted the fix-sentryapp-feature-description-xss branch January 15, 2026 07:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Scope: Frontend Automatically applied to PRs that change frontend components

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants