rules-frontend

next.config file lacks a Content-Security-Policy header. Without CSP, XSS payloads can load external scripts or exfiltrate data. Add a 'Content-Security-Policy' header in the headers() async function with at minimum 'default-src self', a nonce-based script-src, and 'upgrade-insecure-requests'.

dangerouslySetInnerHTML bypasses React's built-in XSS sanitization — CWE-79. Any unsanitized string passed to __html will be interpreted as HTML and can execute attacker-controlled scripts. If rich text is required, use a vetted sanitizer (DOMPurify) and pass the result: dangerouslySetInnerHTML={{ __html: DOMPurify.sanitize(input) }}.

eval() in frontend code — CWE-94 / CWE-79. eval() executes an arbitrary string as code; if any part of the string derives from user input or a third-party source it is a direct XSS/code-injection vector. Replace dynamic code execution with data-driven logic, a safe expression evaluator, or JSON.parse for structured data.

Direct .innerHTML assignment — CWE-79. Assigning user-controlled strings to .innerHTML injects raw HTML into the DOM and executes any embedded scripts. Prefer .textContent for plain text, or sanitize with DOMPurify before assigning to innerHTML.

new Function() is equivalent to eval() — CWE-94. It constructs a callable function from a string, executing arbitrary code. Any user-controlled string passed to it is a code injection vector. Rewrite using pure functions, closures, or a sandboxed interpreter with a restricted grammar.

Potential open redirect using user-controlled query parameter — CWE-601. Passing request params directly to window.location or redirect() allows an attacker to redirect users to a phishing site. Validate the target URL against an allowlist of trusted origins before redirecting.

Next.js Server Action detected without visible Zod validation. Server Actions receive untrusted client input directly — validate every argument with Zod (or equivalent) before using it in queries or mutations to prevent injection and unexpected data shapes.