Problem
Post content submitted by users is stored in the database and rendered to other users without sanitization. An attacker who creates a post containing a script tag or an event-handler attribute (e.g., <img src=x onerror=alert(document.cookie)>) can execute arbitrary JavaScript in the browser of every user who views the post. On a social platform, a self-propagating XSS payload can spread to thousands of users through the feed.
Steps to Reproduce
- Create a post with the body:
<script>alert("XSS")</script>
- View the feed as another user
- Observe the script executes in the victim's browser
Proposed Fix
Sanitize post content on the server before storage AND before rendering:
const createDOMPurify = require("dompurify");
const { JSDOM } = require("jsdom");
const window = new JSDOM("").window;
const DOMPurify = createDOMPurify(window);
const safeContent = DOMPurify.sanitize(req.body.content, {
ALLOWED_TAGS: ["b", "i", "em", "strong", "a", "p", "br"],
ALLOWED_ATTR: ["href"],
});Never trust client-side sanitization alone. Always sanitize on the server side.
Complexity: Level 3 | Program: GSSOC '26
Problem
Post content submitted by users is stored in the database and rendered to other users without sanitization. An attacker who creates a post containing a script tag or an event-handler attribute (e.g.,
<img src=x onerror=alert(document.cookie)>) can execute arbitrary JavaScript in the browser of every user who views the post. On a social platform, a self-propagating XSS payload can spread to thousands of users through the feed.Steps to Reproduce
<script>alert("XSS")</script>Proposed Fix
Sanitize post content on the server before storage AND before rendering:
Never trust client-side sanitization alone. Always sanitize on the server side.
Complexity: Level 3 | Program: GSSOC '26