🛡️ Sentinel: [HIGH] Fix XSS vulnerability in citation add modal

[aicoder2009]

🚨 Severity: HIGH
💡 Vulnerability: Cross-Site Scripting (XSS) was possible because dangerouslySetInnerHTML was rendering dynamically generated HTML without sanitizing it first in the CitationAddModal.
🎯 Impact: If an attacker crafted a malicious URL, DOI, or manual citation that returned malicious script tags in the generated HTML, it would execute in the user's browser, potentially leading to session hijacking, data theft, or unauthorized actions.
🔧 Fix: Imported DOMPurify from isomorphic-dompurify and used DOMPurify.sanitize(generatedCitation.html) to strip any potentially dangerous script tags before it is rendered to the DOM, effectively preventing the XSS payload from executing. This matches the patterns already used in other components like SortableCitation.
✅ Verification:

1. Ran pnpm lint and pnpm test:run - all pass.
2. Verified that DOMPurify.sanitize() is correctly applied in dangerouslySetInnerHTML.

---

PR created automatically by Jules for task 9143635708794283471 started by @aicoder2009

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
opencitation	Ready	Preview, Comment	May 1, 2026 6:27pm

[Copilot]

Pull request overview

This PR addresses a high-severity XSS risk in the wiki “Add Citation” modal by sanitizing dynamically generated citation HTML before rendering it via dangerouslySetInnerHTML, aligning the modal’s behavior with existing sanitization patterns used elsewhere in the app.

Changes:

• Add isomorphic-dompurify usage to sanitize generatedCitation.html before rendering in CitationAddModal.
• Update .jules/sentinel.md to document the vulnerability and the prevention approach.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
src/components/wiki/citation-add-modal.tsx	Sanitizes the citation preview HTML with DOMPurify before injecting into the DOM.
.jules/sentinel.md	Updates internal security log entry describing the issue and prevention guidance.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.