Hey @SBisson, @Varnent -

Thanks for filing this bug. I think there may still be a question as to whether the Security-Team actually needs to review this or not - we should be able to make that decision soon after a bit more consideration. If we do perform the review this quarter, it will likely go to our incoming appsec engineer who is supposed to onboard with us this November. Thanks.

Our newest appsec engineer, @mmartorana, will be working on this review for this quarter (Q2 2021 - October through December).

Security Review Summary - T293369 - 2022-01-07
Last commit reviewed: 4583e736243d46857d982c16be0850112db892b1

Overall, the Wikipedia Preview Wordpress plugin v1.2.0, looks good from a security point of view and is compliant with the Wordpress policies, with an overall risk rating of: low.

Vulnerable Packages - Production

Vulnerable Packages - Development

Outdated Packages
As reported via npm outdated:
(no explicit vulnerabilities reported, simply noting for completeness' sake.)

Static Analysis Findings
Some potential vulnerabilities/anti-patterns have been found through Semgrep.

1. In src/link/preview.js, we can find the method: dangerouslySetInnerHTML which is considered risky as it may expose users to XSS attacks. https://sg.run/rAx6

66:					<div
67:						className="wikipediapreview-edit-preview"
68:						dangerouslySetInnerHTML={ { __html: previewHtml } }
69:					></div>

2. In src/link/api.js, user controlled data in a tmp is an anti-pattern that can lead to XSS vulnerabilities. https://sg.run/70Zv

107:	tmp.innerHTML = html;

3. In src/link/inline.js, "ref" usage has been detected; refs give direct DOM access and may create a possibility for XSS. https://sg.run/v0dX

30:	const inputRef = createRef();
--------------------------------------------------------------------------------
98:						<TextControl
99:							className={ `wikipediapreview-edit-inline-search-input ${
100:								langCodeAdjustment ? 'lang-code-adjustment' : ''
101:							}` }
102:							ref={ inputRef }
103:							value={ title }
104:							onChange={ setTitle }
105:							onFocus={ () => setFocused( true ) }
106:							onBlur={ () => setFocused( false ) }
107:							placeholder={ __(

Risk: low.

Thank you @mmartorana