From 21b1cb9a54942245c56a52ef51f98049abd14f04 Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Sun, 5 Jul 2026 04:08:24 +0000
Subject: [PATCH] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20[HIGH]=20Fi?=
 =?UTF-8?q?x=20XSS=20in=20blog=20route=20and=20harden=20JSON-LD=20metadata?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Implemented safe HTML escaping in the custom markdown-lite renderer for blog posts.
- Added a shared `escapeHTML` utility in `src/lib/api.ts`.
- Exported `safeJsonLd` and added `createArticleSchema` to safely handle JSON-LD metadata in routes.
- Sanitized URLs in blog content to prevent `javascript:` protocol injection.
- Added a security learning entry in `.jules/sentinel.md`.

Co-authored-by: Simonc44 <216070312+Simonc44@users.noreply.github.com>
---
 .jules/sentinel.md        |  6 ++++++
 src/lib/api.ts            |  9 +++++++++
 src/routeTree.gen.ts      | 10 ++++++++++
 src/routes/__root.tsx     | 23 ++++++++++++++++++++++-
 src/routes/blog.$slug.tsx | 29 ++++++++++++++---------------
 5 files changed, 61 insertions(+), 16 deletions(-)

diff --git a/.jules/sentinel.md b/.jules/sentinel.md
index b5cd688..65c73f5 100644
--- a/.jules/sentinel.md
+++ b/.jules/sentinel.md
@@ -15,3 +15,9 @@
 **Vulnerability:** Running `pnpm install` in the agent environment caused an unintended downgrade of `lucide-react` in `pnpm-lock.yaml`.
 **Learning:** The agent's global or cached `pnpm` version/config might conflict with the project's lockfile, especially when specific versions are pinned in `package.json`.
 **Prevention:** Always verify lockfile changes after installation and use `git checkout` to restore unrelated changes if they occur.
+
+## 2026-07-05 - [XSS in Custom Markdown Renderer]
+
+**Vulnerability:** The custom markdown-lite renderer in `blog.$slug.tsx` was using `dangerouslySetInnerHTML` without escaping the input text, allowing arbitrary HTML injection.
+**Learning:** Custom renderers using `dangerouslySetInnerHTML` must escape all HTML special characters (&, <, >, ", ') *before* applying safe transformations (like regex-based bolding or links) to ensure defense-in-depth.
+**Prevention:** Use a shared `escapeHTML` utility and a "strict escape first, then transform" pattern for any manual HTML construction.
diff --git a/src/lib/api.ts b/src/lib/api.ts
index 0773474..7fff65f 100644
--- a/src/lib/api.ts
+++ b/src/lib/api.ts
@@ -182,6 +182,15 @@ export function sanitizeNumero(numero: unknown): string {
   return "";
 }
 
+export function escapeHTML(s: string): string {
+  return s
+    .replace(/&/g, "&amp;")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;")
+    .replace(/"/g, "&quot;")
+    .replace(/'/g, "&#039;");
+}
+
 export function normalize(s: string): string {
   if (!s || typeof s !== "string") return "";
   return s
diff --git a/src/routeTree.gen.ts b/src/routeTree.gen.ts
index 96a30ec..1464a14 100644
--- a/src/routeTree.gen.ts
+++ b/src/routeTree.gen.ts
@@ -403,3 +403,13 @@ const rootRouteChildren: RootRouteChildren = {
 export const routeTree = rootRouteImport
   ._addFileChildren(rootRouteChildren)
   ._addFileTypes<FileRouteTypes>()
+
+import type { getRouter } from './router.tsx'
+import type { startInstance } from './start.ts'
+declare module '@tanstack/react-start' {
+  interface Register {
+    ssr: true
+    router: Awaited<ReturnType<typeof getRouter>>
+    config: Awaited<ReturnType<typeof startInstance.getOptions>>
+  }
+}
diff --git a/src/routes/__root.tsx b/src/routes/__root.tsx
index 735b26e..fa62d30 100644
--- a/src/routes/__root.tsx
+++ b/src/routes/__root.tsx
@@ -126,7 +126,7 @@ export function createSeoMeta(config: SeoConfig) {
  * Sécurise une chaîne JSON pour injection dans une balise <script type="application/ld+json">.
  * Échappe les caractères '<', '>', '&' pour éviter l'injection de scripts (XSS).
  */
-function safeJsonLd(json: string): string {
+export function safeJsonLd(json: string): string {
   return json
     .replace(/</g, "\\u003c")
     .replace(/>/g, "\\u003e")
@@ -134,6 +134,27 @@ function safeJsonLd(json: string): string {
     .replace(/\//g, "\\/");
 }
 
+export function createArticleSchema(article: {
+  title: string;
+  description: string;
+  date: string;
+  author: string;
+  url: string;
+}) {
+  return safeJsonLd(
+    JSON.stringify({
+      "@context": "https://schema.org",
+      "@type": "Article",
+      headline: article.title,
+      description: article.description,
+      datePublished: article.date,
+      author: { "@type": "Organization", name: article.author },
+      publisher: { "@type": "Organization", name: "Mandat" },
+      mainEntityOfPage: article.url,
+    }),
+  );
+}
+
 export function createBreadcrumbSchema(
   breadcrumbs: Array<{ name: string; url: string }>,
 ) {
diff --git a/src/routes/blog.$slug.tsx b/src/routes/blog.$slug.tsx
index 72d6416..f691f87 100644
--- a/src/routes/blog.$slug.tsx
+++ b/src/routes/blog.$slug.tsx
@@ -1,7 +1,8 @@
 import { createFileRoute, Link, notFound } from "@tanstack/react-router";
 import { Calendar, Clock, ArrowLeft } from "lucide-react";
 import { getPostBySlug, getAllPosts, type BlogPost } from "@/lib/blog";
-import { createSeoMeta, SITE_URL } from "./__root";
+import { escapeHTML } from "@/lib/api";
+import { createSeoMeta, createArticleSchema, SITE_URL } from "./__root";
 
 export const Route = createFileRoute("/blog/$slug")({
   loader: ({ params }) => {
@@ -25,15 +26,12 @@ export const Route = createFileRoute("/blog/$slug")({
       scripts: [
         {
           type: "application/ld+json",
-          children: JSON.stringify({
-            "@context": "https://schema.org",
-            "@type": "Article",
-            headline: post.title,
+          children: createArticleSchema({
+            title: post.title,
             description: post.description,
-            datePublished: post.date,
-            author: { "@type": "Organization", name: post.author },
-            publisher: { "@type": "Organization", name: "Mandat" },
-            mainEntityOfPage: url,
+            date: post.date,
+            author: post.author,
+            url,
           }),
         },
       ],
@@ -71,7 +69,7 @@ function renderContent(md: string) {
             <li
               key={j}
               dangerouslySetInnerHTML={{
-                __html: it.replace(
+                __html: escapeHTML(it).replace(
                   /\*\*(.+?)\*\*/g,
                   '<strong class="text-ink">$1</strong>',
                 ),
@@ -86,11 +84,12 @@ function renderContent(md: string) {
         key={i}
         className="my-5 text-lg leading-relaxed text-ink/85"
         dangerouslySetInnerHTML={{
-          __html: b
-            .replace(
-              /\[([^\]]+)\]\(([^)]+)\)/g,
-              '<a href="$2" class="text-primary underline underline-offset-4 hover:opacity-80">$1</a>',
-            )
+          __html: escapeHTML(b)
+            .replace(/\[([^\]]+)\]\(([^)]+)\)/g, (m, text, url) => {
+              const safeUrl = url.replace(/["'<>]/g, "").trim();
+              if (safeUrl.toLowerCase().startsWith("javascript:")) return text;
+              return `<a href="${safeUrl}" class="text-primary underline underline-offset-4 hover:opacity-80">${text}</a>`;
+            })
             .replace(
               /\*\*(.+?)\*\*/g,
               '<strong class="text-ink font-medium">$1</strong>',