[CRITICAL] SSRF/Vulnerability: ProjectCard iframe loads arbitrary URLs

[saidai-bhuvanesh]

🚨 Security Issue: Arbitrary URL Loading in iframe

Severity: CRITICAL
File: src/components/ui/ProjectCard.jsx

Problem

The iframe directly uses project.demoUrl without validation:

<iframe src={project.demoUrl || `/live/${project.slug}/index.html`} />

Attack Vectors

1. Phishing: Malicious demoUrl loads fake login pages
2. XSS via data: URIs: data:text/html,<script>alert(1)</script>
3. Internal Network Scanning: http://localhost:8080/admin

Fix Required

const ALLOWED = ["github.io", "vercel.app", "netlify.app"];
function isSafe(url) {
  try {
    const u = new URL(url);
    return ALLOWED.some(d => u.hostname.endsWith(d));
  } catch { return false; }
}

Labels: bug, ssoc26

[github-actions]

Thank you for raising this issue! We'll look into it as soon as possible. Please ensure that the issue is not a duplicate, and read CONTRIBUTING.md carefully before contributing. Your contributions are highly appreciated! 😊

[saidai-bhuvanesh]

/assign

[MistryVishwa]

@saidai-bhuvanesh Assigned. You can start working on this.