XSS when sending chat messages

[Aamil-Patel]

Summary

Chat messages currently render markdown links without protocol sanitization, allowing javascript: URLs to become clickable in the UI.

Affected Area

frontend/src/components/Dashboard/ChatArea.js (marked(...) output passed to dangerouslySetInnerHTML)

Reproduction

1. Send a message containing:
   [go](javascript:window.location='https://example.com')
2. View the message in chat.
3. The rendered go text is clickable and uses a javascript: URL.

Expected

Unsafe URL schemes should never be rendered as clickable links.

Actual

Unsafe schemes are rendered as anchor href values.

Impact

Potential client-side script execution / malicious redirects through user-generated message content.

Proposed Fix

• Add a custom marked.Renderer for links.
• Allow only http:, https:, mailto:, tel:.
• Render unsafe links as plain text.
• Strip raw HTML tokens from markdown output before injecting HTML.

Patch

See attached file

ChatArea.js