Skip to content

fix(security): sanitize user inputs#1269

Open
jwidan wants to merge 2 commits intoEqual-Vote:mainfrom
jwidan:fix/input-sanitization
Open

fix(security): sanitize user inputs#1269
jwidan wants to merge 2 commits intoEqual-Vote:mainfrom
jwidan:fix/input-sanitization

Conversation

@jwidan
Copy link
Collaborator

@jwidan jwidan commented Mar 9, 2026

Description

  • Markdown was initially sanitized, but then manipulated with some regex. Reordered to safely scrub the final HTML output.
  • Created escapeHtml to strictly encode election titles and descriptions before dynamically injecting them into the SSR meta tags
  • Enforced HTML escaping on titles in EmailTemplates.ts

Screenshots / Videos (frontend only)

Before:
image

After:
image

* Reorder formatMarkdown.ts sanitization
* Explicitly escape election titles and descriptions in Util.ts
* Apply HTML escaping to election titles for outbound emails
@netlify
Copy link

netlify bot commented Mar 9, 2026

Deploy Preview for bettervoting ready!

Name Link
🔨 Latest commit c3130bc
🔍 Latest deploy log https://app.netlify.com/projects/bettervoting/deploys/69b201c973ae73000888f6d6
😎 Deploy Preview https://deploy-preview-1269--bettervoting.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

@ArendPeter ArendPeter requested a review from JonBlauvelt March 11, 2026 18:24
@ArendPeter ArendPeter mentioned this pull request Mar 11, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants