fix: Fix stored XSS when rendering tooltips (#4770)

Flagsmith · Oct 25, 2024 · 96f62c7 · 96f62c7
1 parent b9fbe52
commit 96f62c7
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/frontend/web/components/Tooltip.tsx b/frontend/web/components/Tooltip.tsx
@@ -2,6 +2,7 @@ import React, { FC, ReactElement, ReactNode, useRef } from 'react'
 import ReactTooltip, { TooltipProps as _TooltipProps } from 'react-tooltip'
 import Utils from 'common/utils/utils'
 import classNames from 'classnames'
+import { sanitize } from 'dompurify'
 
 export type TooltipProps = {
   title: ReactNode
@@ -44,7 +45,7 @@ const Tooltip: FC<TooltipProps> = ({
           ) : (
             <div
               style={{ wordBreak: 'break-word' }}
-              dangerouslySetInnerHTML={{ __html: children }}
+              dangerouslySetInnerHTML={{ __html: sanitize(children) }}
             />
           )}
         </ReactTooltip>