diff --git a/.jules/sentinel.md b/.jules/sentinel.md new file mode 100644 index 0000000..add14aa --- /dev/null +++ b/.jules/sentinel.md @@ -0,0 +1,4 @@ +## 2024-05-24 - [dangerouslySetInnerHTML XSS Vulnerability] +**Vulnerability:** Found a Cross-Site Scripting (XSS) vulnerability in `RoomAIChat` where chat messages were being rendered using `dangerouslySetInnerHTML` to support `
` tags for newlines. +**Learning:** Using `.replace(/\n/g, '
')` paired with `dangerouslySetInnerHTML` is a highly dangerous pattern in React that inadvertently allows malicious HTML/JS execution if user input flows through it (e.g. chat messages). +**Prevention:** Always use standard React text rendering `{msg.content}` paired with CSS `white-space: pre-wrap` (or Tailwind's `whitespace-pre-wrap`) to safely render text with line breaks without exposing the app to XSS risks. \ No newline at end of file diff --git a/src/app/about/page.tsx b/src/app/about/page.tsx deleted file mode 100644 index 1d7e5cc..0000000 --- a/src/app/about/page.tsx +++ /dev/null @@ -1,162 +0,0 @@ -"use client"; - -import { motion } from "framer-motion"; -import { RetroBackground } from "@/components/ui/retro-background"; -import { Button } from "@/components/ui/button"; -import Link from "next/link"; -import { ArrowLeft, Rocket, Users, Target, Clock } from "lucide-react"; - -export default function AboutPage() { - return ( -
- {/* Subtle background */} -
- -
- -
-
- -
- SYSTEM // MISSION -
-
- -
- {/* Mission Statement */} -
- - Redefining Digital Proximity. - - - We believe the internet lost its soul when it became - "content-first". VIRE is building a "connection-first" layer for - the web, where shared experiences matter more than metrics. - -
- - {/* Values Grid */} -
- {[ - { - icon: Users, - title: "Connection First", - desc: "Algorithms should serve relationships, not advertisers.", - }, - { - icon: Target, - title: "Zero Latency", - desc: "Real-time means real-time. No delays, no buffering.", - }, - { - icon: Rocket, - title: "User Agency", - desc: "You control your data, your room, and your rules.", - }, - ].map((item, i) => ( - - -

- {item.title} -

-

{item.desc}

-
- ))} -
- - {/* Timeline */} -
-

- Origin Story -

-
- {[ - { - year: "2025", - title: "The Prototype", - desc: "Two friends hacked together a sync engine over a weekend.", - }, - { - year: "2025", - title: "Alpha V1", - desc: "Closed testing with 50 users. Rewrote the core text stack.", - }, - { - year: "2026", - title: "Public Beta", - desc: "Opening the doors to the world. And we're just getting started.", - }, - ].map((item, i) => ( -
-
-
- {item.year} -
-
- {item.title} -
-

{item.desc}

-
- ))} -
-
- - {/* The Team */} -
-

The Team

-
- {[ - { name: "Deepak ", role: "Founder" }, - { name: "Ayush ", role: "Co-Founder" }, - { name: "You?", role: "Join Us" }, - ].map((member, i) => ( -
-
- {i === 3 ? ( - "?" - ) : ( - - {member.name[0]} - - )} -
-
{member.name}
-
- {member.role} -
-
- ))} -
-
-
-
-
- ); -} diff --git a/src/components/room/ai-chat.tsx b/src/components/room/ai-chat.tsx index 87b3cf5..ab6f8fe 100644 --- a/src/components/room/ai-chat.tsx +++ b/src/components/room/ai-chat.tsx @@ -185,7 +185,7 @@ export function RoomAIChat({ : "bg-purple-500/10 border border-purple-500/20 text-purple-100", )} > -
') }} /> +
{msg.content}
{/* Render Options Buttons */} {msg.options && msg.options.length > 0 && (