🛡️ Sentinel: [HIGH] Fix XSS vulnerability via finding references in dashboard

[seonghobae]

🛡️ Sentinel: [HIGH] Fix XSS vulnerability via finding references in dashboard

🚨 Severity: HIGH
💡 Vulnerability: Cross-Site Scripting (XSS) via javascript: URIs in href attributes in scanner/dashboard/index.html. Unvalidated f.references values were injected into href attributes with only HTML entity escaping via esc(), which does not neutralize dangerous schemes.
🎯 Impact: An attacker controlling finding references could inject javascript: links. When clicked by a user viewing the dashboard, this executes malicious script in the context of the dashboard UI.
🔧 Fix: Added a safeUrl function that uses the URL constructor to enforce an allow-list of safe schemes (http: and https:). If an invalid or dangerous scheme is detected, the URL defaults to #. Wrapped reference variables with safeUrl() prior to escaping them for href attributes.
✅ Verification: Tested against javascript: and valid URLs. javascript: yields # and http/https maintain integrity without breaking existing relative resolution. Verified functionality using frontend Playwright tests and screenshot evaluation.

---

PR created automatically by Jules for task 12819296028217201110 started by @seonghobae

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[Copilot]

Pull request overview

This PR mitigates an XSS vector in the scanner dashboard by preventing untrusted f.references values from injecting dangerous URI schemes into href attributes.

Changes:

• Added a safeUrl() helper that allow-lists http:/https: URLs.
• Updated reference link rendering to apply safeUrl() before HTML escaping.
• Documented the XSS finding and prevention guidance in .jules/sentinel.md.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
scanner/dashboard/index.html	Adds URL scheme allow-listing and applies it to rendered reference links to prevent javascript:-scheme XSS.
.jules/sentinel.md	Records the XSS vulnerability, learning, and prevention guidance for future reference.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

scanner/dashboard/index.html:120

• safeUrl returns the original u when the parsed URL is http/https, which means non-string inputs (e.g., null, objects) are treated as relative URLs by new URL(...) and then returned as-is. This can produce empty/odd href values (e.g., null becomes href="") instead of defaulting to # as intended for invalid inputs. Coerce to a trimmed string up front and reject non-strings/empty strings before parsing.

function safeUrl(u){
  try {
    const parsed = new URL(u, window.location.href);
    if (parsed.protocol === 'http:' || parsed.protocol === 'https:') return u;
  } catch(e){}
  return '#';
}