bcgov / bcgov/entity

MHR/PPR UI Updates from Recent Security Audit

Open
#34,519 0 comments 0 reactions 0 assignees View on GitHub
Assets Colin Egress techdebt
Dominant language
JavaScript
Stars
23
Forks
62
Avg merge
24m
Merged PRs (30d)
1

Description

Address UI vulnerabilities identified in a recent security audit report.

| Severity | Category | Title | Affected Component |
| :--- | :--- | :--- | :--- |
| **HIGH** | Cross-Site Scripting | Unsanitized `v-html` Rendering of User Input | `ppr-ui` |

### Stored Cross-Site Scripting (XSS) via Unsanitized `v-html` Rendering
- **Severity**: High (CVSS 7.2)
- **Category**: CWE-79 (Cross-Site Scripting)
- **Locations**:
- [`ppr-ui/src/components/collateral/general/GenColSummary.vue:L115, L133, L188, L206, L232, L248`](file:///Users/thor/Developer/redteam/ppr/ppr-ui/src/components/collateral/general/GenColSummary.vue#L115)
- [`ppr-ui/src/components/unitNotes/UnitNoteReviewDetailsTable.vue:L49`](file:///Users/thor/Developer/redteam/ppr/ppr-ui/src/components/unitNotes/UnitNoteReviewDetailsTable.vue#L49)
- [`ppr-ui/src/components/common/CautionBox.vue:L9`](file:///Users/thor/Developer/redteam/ppr/ppr-ui/src/components/common/CautionBox.vue#L9)

#### Description
In `GenColSummary.vue` and `UnitNoteReviewDetailsTable.vue`, user-submitted text descriptions (such as general collateral additions/deletions or unit note remarks) are rendered directly using Vue's `v-html` directive:

```html

```

If an attacker inputs malicious HTML tags (e.g., ``) into collateral text fields, the script will execute in the browser of any user or staff member reviewing the registration.

#### Remediation
Replace `v-html` with standard Vue text interpolation `{{ ... }}` or sanitize inputs using DOMPurify before rendering:
```html
{{ lastGeneralCollateral.descriptionAdd }}
```

Contributor guide

No contributing guide indexed for this repository

Research direction

Review the listed v-html locations in ppr-ui/src/components/collateral/general/GenColSummary.vue, ppr-ui/src/components/unitNotes/UnitNoteReviewDetailsTable.vue, and ppr-ui/src/components/common/CautionBox.vue. Replace unsafe rendering with text interpolation or sanitize the values as appropriate, then verify that user-supplied text is displayed without executing HTML or scripts.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
frontend, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.