16 lines
1.2 KiB
JSON
16 lines
1.2 KiB
JSON
{
|
|
"feature_id": "F-062",
|
|
"agent": "security",
|
|
"verdict": "APPROVED",
|
|
"summary": "No new attack surface. The Lexical editor runs in the admin's existing authenticated context (cookie auth via the same proxy). HTML output is stored on the existing column and rendered on the public side with the same dangerouslySetInnerHTML path used before. The round-trip test confirmed no payload is escaped — admins already had full HTML control over this field, so the surface is unchanged.",
|
|
"evidence": [
|
|
"Lexical runs only on the admin app (apps/admin), not on the public storefront/frontend",
|
|
"Bundle inspection confirms lexical/* is in the admin chunks only",
|
|
"No new endpoints, no new headers, no new env vars",
|
|
"HTML output flows through the existing PATCH /api/cms/pages/:id validation (zod body schema)",
|
|
"Public-side render unchanged: still uses dangerouslySetInnerHTML on body — this was already the case before F-062",
|
|
"Lexical commands are dispatched only inside the editor instance; no user-supplied strings reach dispatchCommand directly",
|
|
"window.prompt for the link URL is sanitised client-side only; the URL passes through TOGGLE_LINK_COMMAND which Lexical validates"
|
|
],
|
|
"timestamp": "2026-08-19T15:05:00Z"
|
|
} |