From 3525c5bbdedcfd899cc85559ead65fa9583b2597 Mon Sep 17 00:00:00 2001
From: ashutoshkumarsingh-dev <ashutoshkumarsingh.dev@gmail.com>
Date: Mon, 25 Aug 2025 16:32:43 +0530
Subject: [PATCH] docs(security): document RichText XSS sanitization context
 for #229

---
 .github/security/229-richtext-xss.md | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)
 create mode 100644 .github/security/229-richtext-xss.md

diff --git a/.github/security/229-richtext-xss.md b/.github/security/229-richtext-xss.md
new file mode 100644
index 00000000..dae8bb7e
--- /dev/null
+++ b/.github/security/229-richtext-xss.md
@@ -0,0 +1,23 @@
+Title: general-editor RichText XSS sanitization
+
+Summary
+
+- Address XSS risk in `general-editor` RichText rendering by sanitizing untrusted HTML prior to rendering.
+- Applies sanitization before `dangerouslySetInnerHTML` and `iframe srcDoc` usage.
+
+Details
+
+- Affected area: `general-editor/src/tags/object/RichText/view.js`
+- Mitigation: Use DOMPurify to sanitize the rendered HTML string.
+- Dependency: `dompurify` declared in `general-editor/package.json`.
+
+PoC (neutralized post-fix)
+
+- `<img src=x onerror=alert('XSS')>`
+- `<svg onload=alert('XSS')>`
+
+Tracking
+
+- Related issue: #229
+
+