Skip to content

Security: Liquifact/Liquifact-frontend

Security

docs/security.md

Security Notes

XSS Prevention

ESLint Rule: react/no-danger

The project enforces the react/no-danger ESLint rule at the error level. Any use of dangerouslySetInnerHTML will cause the build to fail.

Audit (2026-06-27)

A full codebase audit found one occurrence of dangerouslySetInnerHTML in production source code:

File Line Usage Verdict
app/layout.js 55 Inline theme script (THEME_SCRIPT constant) — runs before React hydration to prevent flash of incorrect theme Safe — static constant, not user-supplied data

All other content is rendered via:

  • Static JSX expressions ({content})
  • JSON.stringify() inside <pre> blocks (safe)
  • Text content through React's built-in escaping

Exception Allowlist

File Reason Approved
app/layout.js:55 Pre-hydration theme script — content is a compile-time constant (THEME_SCRIPT), no user input involved. Required for flash-free theme toggle. ✅

CI Enforcement

The lint step in CI runs npm run lint, which includes the react/no-danger rule. Any new introduction of dangerouslySetInnerHTML will be caught and block the pipeline.

Dependencies

  • eslint-plugin-react (bundled via eslint-config-next) — provides the react/no-danger rule.
  • The rule is configured in eslint.config.mjs.

Last updated: 2026-06-27

There aren't any published security advisories