shadowdaoandClaude Opus 4.8
591a51dcc2
An adversarial pass found 5 Critical XSS sinks where props declared number/enum in TypeScript were interpolated raw into exported HTML attribute values, trusting the type — but nothing enforces it at runtime (AI update_props only validates node_id; deserialized saved state is untyped JSON). Fixed all 5 (NumberCounter data-target, StarRating aria-label, FormContainer method, ContactForm/InputField input type) plus 6 sibling sinks found by an exhaustive audit of every attribute-value interpolation across src/components: a JS-source injection into ContentSlider's inline setInterval script, a prototype-pollution-adjacent allowlist gap in Section's divider-shape lookup, TextareaField rows, Testimonials rating aria-label, HeroSimple textAlign, and MapEmbed zoom. Adds shared sanitizeFormMethod/sanitizeInputType allowlist helpers to utils/escape.ts alongside the existing escapeAttr/safeUrl/cssValue primitives. Every fix is TDD'd: a malicious-value test reproduces the raw injection against the pre-fix code, then passes after the fix. 502 tests green (npx vitest run), tsc + vite build green (npm run build). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
84 lines
2.3 KiB
TypeScript
84 lines
2.3 KiB
TypeScript
import React, { CSSProperties } from 'react';
|
|
import { useNode, Element, UserComponent } from '@craftjs/core';
|
|
import { Container } from '../layout/Container';
|
|
import { cssPropsToString } from '../../utils/style-helpers';
|
|
import { relayFormWiring } from '../../utils/form-relay-wiring';
|
|
import { sanitizeFormMethod } from '../../utils/escape';
|
|
|
|
interface FormContainerProps {
|
|
action?: string;
|
|
method?: 'GET' | 'POST';
|
|
recipientEmail?: string;
|
|
thankYouUrl?: string;
|
|
style?: CSSProperties;
|
|
children?: React.ReactNode;
|
|
}
|
|
|
|
export const FormContainer: UserComponent<FormContainerProps> = ({
|
|
action = '#',
|
|
method = 'POST',
|
|
style = {},
|
|
}) => {
|
|
const { connectors: { connect, drag } } = useNode();
|
|
|
|
return (
|
|
<form
|
|
ref={(ref: HTMLFormElement | null): void => { if (ref) connect(drag(ref)); }}
|
|
action={action}
|
|
method={method}
|
|
onSubmit={(e) => e.preventDefault()}
|
|
style={{
|
|
padding: '24px',
|
|
minHeight: '80px',
|
|
...style,
|
|
}}
|
|
>
|
|
<Element
|
|
id="form-inner"
|
|
is={Container}
|
|
canvas
|
|
style={{ display: 'flex', flexDirection: 'column', gap: '16px', padding: '0' }}
|
|
tag="div"
|
|
/>
|
|
</form>
|
|
);
|
|
};
|
|
|
|
/* ---------- Craft config ---------- */
|
|
|
|
FormContainer.craft = {
|
|
displayName: 'Form',
|
|
props: {
|
|
action: '#',
|
|
method: 'POST',
|
|
recipientEmail: '',
|
|
thankYouUrl: '',
|
|
style: {
|
|
padding: '24px',
|
|
backgroundColor: '#ffffff',
|
|
borderRadius: '8px',
|
|
border: '1px solid #e4e4e7',
|
|
},
|
|
},
|
|
rules: {
|
|
canDrag: () => true,
|
|
canMoveIn: () => false,
|
|
canMoveOut: () => true,
|
|
},
|
|
};
|
|
|
|
/* ---------- HTML export ---------- */
|
|
|
|
(FormContainer as any).toHtml = (props: FormContainerProps, childrenHtml: string, nodeId?: string) => {
|
|
const styleStr = cssPropsToString({
|
|
padding: '24px',
|
|
...props.style,
|
|
});
|
|
const { useRelay, marker, actionAttr, honeypot } = relayFormWiring(props.recipientEmail, props.thankYouUrl, props.action, nodeId);
|
|
const method = useRelay ? 'POST' : sanitizeFormMethod(props.method); // relay requires POST
|
|
const body = honeypot + childrenHtml; // honeypot as first child
|
|
return {
|
|
html: `${marker}<form action="${actionAttr}" method="${method}"${styleStr ? ` style="${styleStr}"` : ''}>${body}</form>`,
|
|
};
|
|
};
|