fix: sanitize HTML response before DOM injection to prevent XSS

[mertcicekci0]

Summary

Fixes a potential XSS vulnerability in the paywall browser entry.

Previously, packages/paywall/src/browser/entry.tsx injected server responses directly into the DOM using:

document.documentElement.innerHTML = await response.text()

While <script> tags are not executed when inserted via innerHTML, inline event handlers (onerror, onclick, onload, etc.) can still execute.
If the response is tampered with (e.g. MITM or compromised upstream), this could lead to DOM-based XSS.

To mitigate this, a sanitization layer has been added before DOM injection.

---

Changes

File	Description
packages/paywall/src/browser/sanitize.ts	Added sanitizeHTML() utility
packages/paywall/src/browser/entry.tsx	Sanitize server response before assigning to innerHTML

Sanitization behavior

sanitizeHTML():

• Parses HTML using DOMParser
• Removes dangerous elements:
  • script
  • iframe
  • object
  • embed
• Strips all inline event handler attributes (on*)

---

Test Plan

• pnpm --filter @x402-stellar/paywall typecheck passes
• Paywall still renders protected HTML after successful payment
• Malicious payloads like:

<img src=x onerror="alert(1)">

are neutralized after sanitization

[Copilot]

Pull request overview

This PR aims to reduce DOM-based XSS risk in the paywall browser entry by sanitizing HTML responses before injecting them into document.documentElement.innerHTML.

Changes:

• Add a sanitizeHTML() helper that parses HTML and removes some dangerous nodes/attributes.
• Update the browser entrypoint to sanitize text/html responses prior to DOM injection.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
packages/paywall/src/browser/sanitize.ts	Introduces a custom HTML sanitization helper.
packages/paywall/src/browser/entry.tsx	Applies sanitization to HTML responses before replacing the document content.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The current sanitizer only removes a small set of elements and strips on* attributes, but it still allows common XSS vectors such as href="javascript:..." / xlink:href, src="javascript:...", formaction/action, srcset with javascript:/data: payloads, and <meta http-equiv="refresh"> redirects. This means the response can still execute script via user interaction or browser behaviors even after sanitization. Consider switching to a well-maintained allowlist sanitizer (e.g., DOMPurify with an explicit config) or, at minimum, additionally strip/validate URL-bearing attributes to disallow dangerous protocols and remove other hazardous elements like meta[http-equiv] and base.

Suggested change

	const EVENT_HANDLER_RE = /^on/i;
	/**
	* Parse an HTML string with DOMParser and strip dangerous content
	* (script/iframe/object/embed elements and inline event-handler attributes)
	* before it is injected into the document via innerHTML.
	*/
	export function sanitizeHTML(raw: string): string {
	const doc = new DOMParser().parseFromString(raw, "text/html");
	const dangerous = doc.querySelectorAll("script, iframe, object, embed");
	for (const el of dangerous) {
	el.remove();
	}
	const all = doc.querySelectorAll("*");
	for (const el of all) {
	for (const attr of [...el.attributes]) {
	if (EVENT_HANDLER_RE.test(attr.name)) {
	el.removeAttribute(attr.name);
	}
	}
	}
	return doc.documentElement.innerHTML;
	import DOMPurify from "dompurify";
	/**
	* Sanitize an HTML string before it is injected into the document via innerHTML.
	*
	* Uses DOMPurify with an explicit configuration to strip dangerous elements,
	* event-handler attributes, and unsafe URL-bearing attributes/protocols.
	*/
	export function sanitizeHTML(raw: string): string {
	return DOMPurify.sanitize(raw, {
	// Explicitly forbid high-risk elements that can change page behavior or
	// introduce script execution or redirects.
	FORBID_TAGS: ["script", "iframe", "object", "embed", "meta", "base"],
	// Forbid particularly risky attributes; DOMPurify also strips `on*` handlers
	// and unsafe URL protocols (e.g. `javascript:`) by default.
	FORBID_ATTR: ["xlink:href", "formaction"],
	});

[Copilot]

src/browser is excluded from this package’s tsc typecheck and ESLint runs, so this new sanitizer logic won’t be statically checked in CI via the existing scripts. Given this is security-sensitive code, it would be safer to add a dedicated browser tsconfig/typecheck step (or include these files) so regressions (e.g., DOM API misuse) are caught early.