Skip to content

fix: [UIE-10152] - Fix html injection vuln in open Support Ticket and Quotas Increase Form.#13404

Open
tanushree-akamai wants to merge 2 commits intolinode:developfrom
tanushree-akamai:feature/UIE-10152-fix-html-injection-vuln
Open

fix: [UIE-10152] - Fix html injection vuln in open Support Ticket and Quotas Increase Form.#13404
tanushree-akamai wants to merge 2 commits intolinode:developfrom
tanushree-akamai:feature/UIE-10152-fix-html-injection-vuln

Conversation

@tanushree-akamai
Copy link
Contributor

@tanushree-akamai tanushree-akamai commented Feb 16, 2026

Description 📝

Fix html injection vuln in open Support Ticket and Quotas Increase Form.

Changes 🔄

  • Enhance sanitizeConfigs to block anchor tags in Markdown Component while preserving safe Markdown formatting in TicketDetailText component
  • Enhance sanitizeConfigs to block anchor tags in Markdown Component while preserving safe Markdown formatting in QuotasIncreaseForm.
  • Centralized sanitizeOptions.ts for consistency in constants.

Scope 🚢

Upon production release, changes in this PR will be visible to:

  • All customers
  • Some customers (e.g. in Beta or Limited Availability)
  • No customers / Not applicable

Preview 📷

SupportTicketDialog
Before
Screenshot 2026-02-16 at 2 26 55 PM
After
Screenshot 2026-02-16 at 2 24 59 PM

QuotasIncreaseForm
Before
Screenshot 2026-02-16 at 2 28 27 PM
After
Screenshot 2026-02-16 at 2 29 38 PM

How to test 🧪

Verification steps

  • Open DevTools Panel
  • In DevTools Panel, enable CRUD MSW
  • Navigate to /linodes
  • Click on Open Support Ticket (verify with required payload)
  • Navigate to /quotas
  • Click on Quota increase form (verify with required payload)
Author Checklists

As an Author, to speed up the review process, I considered 🤔

👀 Doing a self review
❔ Our contribution guidelines
🤏 Splitting feature into small PRs
➕ Adding a changeset
🧪 Providing/improving test coverage
🔐 Removing all sensitive information from the code and PR description
🚩 Using a feature flag to protect the release
👣 Providing comprehensive reproduction steps
📑 Providing or updating our documentation
🕛 Scheduling a pair reviewing session
📱 Providing mobile support
♿ Providing accessibility support


  • I have read and considered all applicable items listed above.

As an Author, before moving this PR from Draft to Open, I confirmed ✅

  • All tests and CI checks are passing
  • TypeScript compilation succeeded without errors
  • Code passes all linting rules

@tanushree-akamai tanushree-akamai requested a review from a team as a code owner February 16, 2026 09:04
@tanushree-akamai tanushree-akamai added the Security Pull requests that address a security vulnerability label Feb 16, 2026
@tanushree-akamai tanushree-akamai self-assigned this Feb 16, 2026
@tanushree-akamai tanushree-akamai force-pushed the feature/UIE-10152-fix-html-injection-vuln branch from b853e04 to cd27bea Compare February 17, 2026 14:39
@linode-gh-bot
Copy link
Collaborator

Cloud Manager UI test results

🔺 1 failing test on test run #3 ↗︎

❌ Failing✅ Passing↪️ Skipped🕐 Duration
1 Failing865 Passing11 Skipped37m 12s

Details

Failing Tests
SpecTest
account-switching.spec.tsCloud Manager Cypress Tests→Parent/Child account switching→From Parent to Child » can search child accounts

Troubleshooting

Use this command to re-run the failing tests:

pnpm cy:run -s "cypress/e2e/core/parentChild/account-switching.spec.ts"

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Ready for Review Security Pull requests that address a security vulnerability

Projects

Status: Review

Development

Successfully merging this pull request may close these issues.

2 participants

Comments