MHR/PPR UI Updates from Recent Security Audit
- Dominant language
- JavaScript
- Stars
- 23
- Forks
- 62
- Avg merge
- 24m
- Merged PRs (30d)
- 1
Description
Address UI vulnerabilities identified in a recent security audit report.
| Severity | Category | Title | Affected Component |
| :--- | :--- | :--- | :--- |
| **HIGH** | Cross-Site Scripting | Unsanitized `v-html` Rendering of User Input | `ppr-ui` |
### Stored Cross-Site Scripting (XSS) via Unsanitized `v-html` Rendering
- **Severity**: High (CVSS 7.2)
- **Category**: CWE-79 (Cross-Site Scripting)
- **Locations**:
- [`ppr-ui/src/components/collateral/general/GenColSummary.vue:L115, L133, L188, L206, L232, L248`](file:///Users/thor/Developer/redteam/ppr/ppr-ui/src/components/collateral/general/GenColSummary.vue#L115)
- [`ppr-ui/src/components/unitNotes/UnitNoteReviewDetailsTable.vue:L49`](file:///Users/thor/Developer/redteam/ppr/ppr-ui/src/components/unitNotes/UnitNoteReviewDetailsTable.vue#L49)
- [`ppr-ui/src/components/common/CautionBox.vue:L9`](file:///Users/thor/Developer/redteam/ppr/ppr-ui/src/components/common/CautionBox.vue#L9)
#### Description
In `GenColSummary.vue` and `UnitNoteReviewDetailsTable.vue`, user-submitted text descriptions (such as general collateral additions/deletions or unit note remarks) are rendered directly using Vue's `v-html` directive:
```html
```
If an attacker inputs malicious HTML tags (e.g., ``) into collateral text fields, the script will execute in the browser of any user or staff member reviewing the registration.
#### Remediation
Replace `v-html` with standard Vue text interpolation `{{ ... }}` or sanitize inputs using DOMPurify before rendering:
```html
{{ lastGeneralCollateral.descriptionAdd }}
```
Contributor guide
No contributing guide indexed for this repository
Research direction
Review the listed v-html locations in ppr-ui/src/components/collateral/general/GenColSummary.vue, ppr-ui/src/components/unitNotes/UnitNoteReviewDetailsTable.vue, and ppr-ui/src/components/common/CautionBox.vue. Replace unsafe rendering with text interpolation or sanitize the values as appropriate, then verify that user-supplied text is displayed without executing HTML or scripts.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- frontend, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 68/100