[dev] [Itsnotaka] daniel/trust-page-improvements

[github-actions]

This is an automated pull request to merge daniel/trust-page-improvements into dev.
It was created by the [Auto Pull Request] action.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Comments	Updated (UTC)
app	Ready	Preview	Comment	Nov 18, 2025 11:12pm
portal	Ready	Preview	Comment	Nov 18, 2025 11:12pm

[comp-ai-code-review]

🔒 Comp AI - Security Review

🟡 Risk Level: MEDIUM

OSV scan: 2 high CVEs in xlsx@0.18.5 (Prototype Pollution, ReDoS) and 1 low CVE in ai@5.0.0 (filetype whitelist bypass).

---

📦 Dependency Vulnerabilities

🟠 NPM Packages (HIGH)

Risk Score: 8/10 | Summary: 2 high, 1 low CVEs found

Package	Version	CVE	Severity	CVSS	Summary	Fixed In
xlsx	0.18.5	GHSA-4r6h-8v6p-xvw6	HIGH	N/A	Prototype Pollution in sheetJS	No fix yet
xlsx	0.18.5	GHSA-5pgg-2g8v-p4x9	HIGH	N/A	SheetJS Regular Expression Denial of Service (ReDoS)	No fix yet
ai	5.0.0	GHSA-rwvc-j5jr-mgvh	LOW	N/A	Vercel’s AI SDK's filetype whitelists can be bypassed when uploading files	5.0.52

---

🛡️ Code Security Analysis

View 1 file(s) with issues

🟡 apps/app/src/app/(app)/[orgId]/trust/components/request-tab.tsx (MEDIUM Risk)

#	Issue	Risk Level
1	Unvalidated pdfDownloadUrl opened via window.open (possible malicious URL)	MEDIUM
2	No validation of requestId before calling mutateAsync	MEDIUM
3	No check that preview result contains pdfDownloadUrl before opening	MEDIUM

Recommendations:

1. Allowlist and validate pdfDownloadUrl scheme and host before opening
2. Ensure result.pdfDownloadUrl exists and is a valid URL before window.open
3. Open external links safely (set window.opener = null or use rel='noopener noreferrer')
4. Validate requestId format (e.g., UUID) before passing to mutateAsync
5. Sanitize/escape any user-originated HTML before rendering

---

💡 Recommendations

View 3 recommendation(s)

1. Upgrade xlsx (v0.18.5) to a version that fixes GHSA-4r6h-8v6p-xvw6 and GHSA-5pgg-2g8v-p4x9; update package.json and lockfile and run tests.
2. Upgrade ai from 5.0.0 to >=5.0.52 (GHSA-rwvc-j5jr-mgvh fixedIn: 5.0.52) and update lockfile.
3. When accepting/processing uploaded spreadsheets, validate file type and size before parsing and perform parsing in a restricted context (or use a streaming/safe parser) to mitigate Prototype Pollution and ReDoS risks.

---

Powered by Comp AI - AI that handles compliance for you. Reviewed Nov 18, 2025

[CLAassistant]

All committers have signed the CLA.

[claudfuen]

🎉 This PR is included in version 1.60.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀