🛡️ Sentinel: [HIGH] Fix Stored XSS vulnerability in deck links

[google-labs-jules]

🚨 Severity: HIGH

💡 Vulnerability: Stored Cross-Site Scripting (XSS)

When creating a deck using the manual deckText and deckLink flow, the deckLink was not validated to ensure it contained a safe URI scheme. The provided string was directly stored in the database.

In the frontend, this stored link was rendered directly into an <a> tag's href attribute in frontend/src/pages/Home.tsx and frontend/src/components/DeckShowcase.tsx. An attacker could provide a malicious deckLink such as javascript:alert(document.cookie) which would execute JavaScript in the victim's browser when they clicked "View source" or the deck link icon.

🎯 Impact

If exploited, this vulnerability could allow an attacker to execute arbitrary JavaScript in the context of another user's session, potentially leading to session hijacking, unauthorized actions on behalf of the user, or data exfiltration.

🔧 Fix

Added a validation check in api/app/api/decks/route.ts using a regex test link.match(/^https?:\/\//i) right before deck creation. If a user provides a deckLink that does not start with http:// or https://, the API will now reject the request with a 400 Bad Request response, preventing the malicious payload from being stored.

✅ Verification

• Verified by running npm test:unit in the api workspace to ensure no regressions were introduced.
• Evaluated the API endpoints manually against malicious inputs to ensure correct behavior.
• Successfully built the application.

---

PR created automatically by Jules for task 10403101528358354258 started by @TytaniumDev

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[claude]

Code Review - Approved

No issues found. Checked for bugs, security issues, and CLAUDE.md compliance.

The added URL scheme validation (/^https?:\/\//i) correctly guards the text-based deck import path against non-HTTP(S) values being stored as the link field (e.g., javascript:, file://, data:). The check is a no-op for the URL-based path since Moxfield/Archidekt/ManaBox URLs are already pattern-validated before link is assigned. Regex and control flow are correct.