Skip to content

MarkdownRenderer sends unsanitized HTML during SSR #1047

Description

@RUKAYAT-CODER

Overview
src/components/shared/MarkdownRenderer.tsx (lines 177-212) returns the raw markdownToHtml output without running DOMPurify when typeof window === 'undefined' (line 179). Because Next.js renders on the server, the initial HTML injected via dangerouslySetInnerHTML is unsanitized until the client hydrates, so untrusted markdown can inject markup/handlers into the server-rendered response. Sanitize on both server and client (e.g. isomorphic DOMPurify).

Metadata

Metadata

Assignees

Labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions