@autobusal/common 1.4.3 → 1.4.4

package/BlogItem/BlogItem.tsx

@@ -1,5 +1,6 @@
 import { TFunction } from 'i18next';
 import { FiCalendar } from 'react-icons/fi';
+import { sanitizeHtml } from '@autobusal/utilities';
 import Image from './Image';
 import { LinkTitle, Details, DisplayDate, TextPreview, TextView, ButtonLink } from './styles';
 import { ArticleData } from '@autobusal/providers/types/articles';
@@ -33,7 +34,7 @@ const BlogItem = ({ article, type, t }: Props): JSX.Element => (
       </TextPreview>
     ) }
 
-    { type === 'view' && <TextView dangerouslySetInnerHTML={{ __html: article.content }} /> }
+    { type === 'view' && <TextView dangerouslySetInnerHTML={{ __html: sanitizeHtml(article.content) }} /> }
   </div>
 );
 

package/CHANGELOG.md

@@ -3,6 +3,12 @@
 All notable changes to `@autobusal/common` are documented here. This project follows
 [Keep a Changelog](https://keepachangelog.com/) and [Semantic Versioning](https://semver.org/).
 
+## [1.4.4] - 2026-07-24
+
+### Fixed
+
+- `BlogItem.tsx` and `Policy.tsx`: article/policy content is now run through `@autobusal/utilities`'s `sanitizeHtml` before being rendered via `dangerouslySetInnerHTML`, closing an XSS gap where an already-compromised admin account could persist JS in blog articles or policy pages.
+
 ## [1.4.3] - 2026-07-19
 
 ### Changed

package/Policy/Policy.tsx

@@ -1,4 +1,5 @@
 import { TFunction } from 'i18next';
+import { sanitizeHtml } from '@autobusal/utilities';
 import Modal from '../Modal/Modal';
 import { useGetPolicy } from './services';
 
@@ -17,7 +18,7 @@ const Policy = ({ id, t, onClose }: Props): JSX.Element => {
       width={ 750 }
       title={ t('policy.title') }
       content={
-        <div dangerouslySetInnerHTML={{ __html: data?.policies ?? '' }} />
+        <div dangerouslySetInnerHTML={{ __html: sanitizeHtml(data?.policies) }} />
       }
       onClose={ onClose }
     />

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@autobusal/common",
-  "version": "1.4.3",
+  "version": "1.4.4",
   "author": "Ferjolt Ozuni",
   "type": "module",
   "main": "index.ts"