From 23a5fb342f76b24fbc83fdca2b46db73aa6c0aff Mon Sep 17 00:00:00 2001
From: Gamosoft <gamosoft@users.noreply.github.com>
Date: Tue, 3 Mar 2026 09:27:01 +0100
Subject: [PATCH] html sanitization to avoid XSS

---
 backend/export.py   | 10 ++++++++--
 frontend/app.js     |  5 +++++
 frontend/index.html |  3 +++
 3 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/backend/export.py b/backend/export.py
index 7833f3a..1020bb3 100644
--- a/backend/export.py
+++ b/backend/export.py
@@ -341,6 +341,9 @@ def generate_export_html(
     <!-- Marked.js for markdown parsing -->
     <script src="https://cdn.jsdelivr.net/npm/marked@12.0.0/marked.min.js"></script>
     
+    <!-- DOMPurify for HTML sanitization (XSS prevention) -->
+    <script src="https://cdn.jsdelivr.net/npm/dompurify@3.0.8/dist/purify.min.js"></script>
+    
     <!-- MathJax for LaTeX math rendering -->
     <script>
         MathJax = {{
@@ -682,8 +685,11 @@ def generate_export_html(
         // Raw markdown content
         const markdown = `{escaped_content}`;
         
-        // Render markdown
-        document.getElementById('content').innerHTML = marked.parse(markdown);
+        // Render markdown with XSS sanitization
+        // DOMPurify strips scripts, iframes, and event handlers while allowing safe HTML/SVG
+        const rawHtml = marked.parse(markdown);
+        const safeHtml = DOMPurify.sanitize(rawHtml);
+        document.getElementById('content').innerHTML = safeHtml;
         
         // Add copy buttons to code blocks
         document.querySelectorAll('.markdown-preview pre').forEach(pre => {{
diff --git a/frontend/app.js b/frontend/app.js
index acc00c4..354e0c0 100644
--- a/frontend/app.js
+++ b/frontend/app.js
@@ -4145,6 +4145,11 @@ function noteApp() {
             // Parse markdown
             let html = marked.parse(contentToRender);
             
+            // Sanitize HTML to prevent XSS attacks
+            // DOMPurify defaults allow most HTML/SVG tags but strip scripts, iframes, and event handlers
+            // MathJax and Mermaid run AFTER this, so their elements don't need whitelisting
+            html = DOMPurify.sanitize(html);
+            
             // Post-process: Add target="_blank" to external links and title attributes to images
             // Parse as DOM to safely manipulate
             const tempDiv = document.createElement('div');
diff --git a/frontend/index.html b/frontend/index.html
index a4e0131..40a52d9 100644
--- a/frontend/index.html
+++ b/frontend/index.html
@@ -63,6 +63,9 @@
     <!-- Marked.js for Markdown parsing (v12.0.2) -->
     <script src="https://cdn.jsdelivr.net/npm/marked@12.0.2/marked.min.js"></script>
     
+    <!-- DOMPurify for HTML sanitization (XSS prevention) -->
+    <script src="https://cdn.jsdelivr.net/npm/dompurify@3.0.8/dist/purify.min.js"></script>
+    
     <!-- MathJax for LaTeX math rendering -->
     <script>
         MathJax = {