Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: add DOMPurify to prevent XSS attacks in the way emojis are rendered #621

Merged
merged 2 commits into from
Sep 11, 2024

Conversation

julio-cfa
Copy link
Member

@julio-cfa julio-cfa commented Sep 11, 2024

Brief Title

This PR adds DOMPurify to certain dangerouslySetInnerHTML attributes, preventing XSS attacks in the way emojis are rendered.

Acceptance Criteria fulfillment

  • Add DOMPurify to EmojiReaction.js and Emoji.js.

Fixes # (issue)

VLN-59

Video/Screenshots

N/A

@CLAassistant
Copy link

CLAassistant commented Sep 11, 2024

CLA assistant check
All committers have signed the CLA.

@Spiral-Memory
Copy link
Contributor

Spiral-Memory commented Sep 11, 2024

Hey @julio-cfa,

Thank you so much for your contribution. I see you are a member of Rocket.Chat. I am just a GSoC Contributor. If you're concerned about Playwright failing, please don't worry. It is failing because it checks whether EmbeddedChat has some messages (in anonymous mode) using Abhinav's personal Rocket.Chat server, which I have changed to demo.qa (provided by devanshu for these purposes) in one of my PRs (which isn't merged yet).

Abhinav's personal Rocket.Chat server is no longer working, which is why the Playwright tests are failing.

Thank you!

@julio-cfa
Copy link
Member Author

Hey @julio-cfa,

Thank you so much for your contribution. I see you are a member of Rocket.Chat. I am just a GSoC Contributor. If you're concerned about Playwright failing, please don't worry. It is failing because it checks whether EmbeddedChat has some messages (in anonymous mode) using Abhinav's personal Rocket.Chat server, which I have changed to demo.qa (provided by devanshu for these purposes) in one of my PRs (which isn't merged yet).

Abhinav's personal Rocket.Chat server is no longer working, which is why the Playwright tests are failing.

Thank you!

Thank you very much for the clarification, @Spiral-Memory! I thought it was some flaky tests misbehaving and tried to re-run them a couple of times to see if it would work, but now it makes sense why they weren't passing.

(And you're not "just a GSoC Contributor", GSoC contributors are super important to us <3)

@abhinavkrin abhinavkrin merged commit 6e6c3b1 into develop Sep 11, 2024
4 of 5 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants