XSS vulnerability: dangerouslySetInnerHTML in chart component
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 48/100
Research direction
Start by reading src/components/ui/chart.tsx around line 81 and trace the value passed to __html, then inspect scripts/scrape_professors.py around line 51. Check whether chart content can contain user-controlled data and where SSL verification is disabled. Done means both unsafe rendering and disabled certificate verification are addressed, with behavior preserved when HTML is not required.
Written by the indexing model from the issue text.
Description
🔍 Issue
`src/components/ui/chart.tsx:81` uses `dangerouslySetInnerHTML` to render chart content.
Context
This appears to be a custom chart component that renders HTML inside the chart labels/tooltips. If any chart data (labels, tooltips, axis values) comes from user input (e.g., course names, professor names, review text), malicious HTML could be injected.
✅ Fix
If this is a shadcn/ui or Radix chart component, the `dangerouslySetInnerHTML` is likely unnecessary. Check:
- What data is being passed to the `__html` prop?
- Can any of that data be user-controlled?
- Switch to safe DOM text rendering or use DOMPurify if HTML rendering is required.
Additionally, `scripts/scrape_professors.py:51` uses `requests.get(url, verify=False)` — disabling SSL verification is dangerous and should be fixed in production.
- Dominant language
- TypeScript
- Stars
- 0
- Forks
- 26
- PR merge metrics
- No merged PRs in 30d
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from OpenLake/RateMyCourse
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
OpenLake/RateMyCourse#66 ·
-
bug help wanted
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
OpenLake/RateMyCourse#61 ·
-
bug help wanted
Difficulty 4/5 3-5 days Newbie friendliness 48/100
OpenLake/RateMyCourse#60 ·
-
advanced bug
Difficulty 3/5 1-2 days Newbie friendliness 48/100
OpenLake/RateMyCourse#59 ·
-
help wanted
Difficulty 5/5 Over a week Newbie friendliness 25/100
OpenLake/RateMyCourse#49 · 1 comment ·
All issues in OpenLake/RateMyCourse
Similar issues
-
VerificationGate: ATTRIBUTION quote guard never matches a normal quotation (\b around the quote) Open
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
danielmiessler/LifeOS#2234 ·
-
T: Bug
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
-
Difficulty 1/5 Under an hour Newbie friendliness 85/100
-
Mend: dependency security vulnerability untriaged
Difficulty 2/5 1-3 hours Newbie friendliness 70/100