HTML and script injection are prevented

Stored XSS (OWASP A03:2021, CWE-79) in user-generated content is one of the most severe vulnerabilities a community platform can have. When unsanitized HTML or script tags are persisted to the database and rendered in other users' browsers, an attacker can steal session cookies, exfiltrate auth tokens, hijack accounts, or redirect victims to phishing pages — all without any interaction beyond viewing a post or comment. Every user who views the malicious content becomes a victim. Client-side sanitization alone is bypassed trivially via direct API calls; server-side sanitization before storage is the only reliable control.

Sanitize all user-generated content server-side before writing to the database. Use dompurify on the backend with a strict allowlist:

import DOMPurify from 'dompurify';
import { JSDOM } from 'jsdom';

const { window } = new JSDOM('');
const purify = DOMPurify(window);

export function sanitizeContent(html) {
  return purify.sanitize(html, {
    ALLOWED_TAGS: ['b', 'i', 'em', 'strong', 'a', 'p', 'br'],
    ALLOWED_ATTR: ['href'],
  });
}

On the frontend, render content as text nodes — never via dangerouslySetInnerHTML — unless the content passed through your server-side sanitizer and you have explicit need for rich HTML. When in doubt, strip all markup.