From f57485ea50b6d1b7edadca0ebd976f0303212823 Mon Sep 17 00:00:00 2001
From: Shivam Mishra <scm.mymail@gmail.com>
Date: Mon, 12 Jan 2026 22:12:56 +0530
Subject: [PATCH] feat: sanitize html before assiging it to tempDiv

---
 .../dashboard/helper/quotedEmailHelper.js     |  3 ++-
 .../helper/specs/quotedEmailHelper.spec.js    | 20 +++++++++++++++++++
 2 files changed, 22 insertions(+), 1 deletion(-)

diff --git a/app/javascript/dashboard/helper/quotedEmailHelper.js b/app/javascript/dashboard/helper/quotedEmailHelper.js
index b72fe8f50..9809b61bf 100644
--- a/app/javascript/dashboard/helper/quotedEmailHelper.js
+++ b/app/javascript/dashboard/helper/quotedEmailHelper.js
@@ -1,4 +1,5 @@
 import { format, parseISO, isValid as isValidDate } from 'date-fns';
+import DOMPurify from 'dompurify';
 
 /**
  * Extracts plain text from HTML content
@@ -13,7 +14,7 @@ export const extractPlainTextFromHtml = html => {
     return html.replace(/<[^>]*>/g, ' ');
   }
   const tempDiv = document.createElement('div');
-  tempDiv.innerHTML = html;
+  tempDiv.innerHTML = DOMPurify.sanitize(html);
   return tempDiv.textContent || tempDiv.innerText || '';
 };
 
diff --git a/app/javascript/dashboard/helper/specs/quotedEmailHelper.spec.js b/app/javascript/dashboard/helper/specs/quotedEmailHelper.spec.js
index 801989124..bc38d09a8 100644
--- a/app/javascript/dashboard/helper/specs/quotedEmailHelper.spec.js
+++ b/app/javascript/dashboard/helper/specs/quotedEmailHelper.spec.js
@@ -33,6 +33,26 @@ describe('quotedEmailHelper', () => {
       expect(result).toContain('Line 1');
       expect(result).toContain('Line 2');
     });
+
+    it('sanitizes onerror handlers from img tags', () => {
+      const html = '<p>Hello</p><img src="x" onerror="alert(1)">';
+      const result = extractPlainTextFromHtml(html);
+      expect(result).toBe('Hello');
+    });
+
+    it('sanitizes script tags', () => {
+      const html = '<p>Safe</p><script>alert(1)</script><p>Content</p>';
+      const result = extractPlainTextFromHtml(html);
+      expect(result).toContain('Safe');
+      expect(result).toContain('Content');
+      expect(result).not.toContain('alert');
+    });
+
+    it('sanitizes onclick handlers', () => {
+      const html = '<p onclick="alert(1)">Click me</p>';
+      const result = extractPlainTextFromHtml(html);
+      expect(result).toBe('Click me');
+    });
   });
 
   describe('getEmailSenderName', () => {