XSS: dangerouslySetInnerHTML in chart component renders unsanitized content

Open
#59 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
48/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Quiet
Tech stack
nextjs, typescript
Domain
frontend, security

Research direction

Start at src/components/ui/chart.tsx:81 and inspect how chart content reaches dangerouslySetInnerHTML. Trace whether labels, tooltips, axis values, or other user-submitted fields can enter this path, then review the project’s existing dependency and data-layer patterns. Done means untrusted chart content is safely handled and the component no longer presents an XSS path.

Written by the indexing model from the issue text.

Description

advanced bug

Issue

src/components/ui/chart.tsx:81 uses dangerouslySetInnerHTML to render chart content:

<div dangerouslySetInnerHTML={{ __html: ... }} />

Why this matters

If any chart data (labels, tooltips, axis values) comes from user-submitted content like course names, professor names, or review text, malicious HTML could be injected. Even if data is currently from trusted sources, this creates a persistent XSS vector if the data source changes in the future.

Fix

Use DOMPurify or sanitize at the data layer before passing to the chart component.

Dominant language
TypeScript
Stars
0
Forks
26
No merged PRs in 30d

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from OpenLake/RateMyCourse

All issues in OpenLake/RateMyCourse

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.