From 89a9bca40ef7ecb8c3abafbc30ba01c876afa906 Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Sat, 26 Sep 2026 04:27:20 +0000
Subject: [PATCH] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20[security?=
 =?UTF-8?q?=20improvement]=20use=20dangerouslySetInnerHTML=20for=20JSON-LD?=
 =?UTF-8?q?=20script?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

🚨 Severity: LOW
💡 Vulnerability: Direct interpolation of JSON-LD string as child of `<script>` tag can cause React escaping/hydration issues or unintentional execution parsing depending on the React version rendering model.
🎯 Impact: Minor runtime warnings/errors in React or potential broken structured data. XSS is already mitigated by `safeJsonLdStringify`.
🔧 Fix: Updated the tag to use React's idiomatic `dangerouslySetInnerHTML={{ __html: JSON_LD_STRING }}`.
✅ Verification: Ran unit tests and lint checks. No regressions found.
---
 .jules/sentinel.md | 4 ++++
 app/page.tsx       | 4 +---
 2 files changed, 5 insertions(+), 3 deletions(-)
 create mode 100644 .jules/sentinel.md

diff --git a/.jules/sentinel.md b/.jules/sentinel.md
new file mode 100644
index 0000000..103f2f8
--- /dev/null
+++ b/.jules/sentinel.md
@@ -0,0 +1,4 @@
+## 2024-05-18 - [Security Best Practice: JSON-LD rendering]
+**Vulnerability:** React script tag execution / escaping issues with hydration when providing children.
+**Learning:** React 19+ explicitly advises against interpolating children directly inside `<script>` tags, especially those containing JSON-LD strings. Instead it expects `dangerouslySetInnerHTML` for the injection. Although `safeJsonLdStringify` handles XSS mitigation, following React's required patterns ensures structural robustness.
+**Prevention:** Always use `dangerouslySetInnerHTML={{ __html: safeJsonLdStringify(data) }}` when adding structured data blocks in React to avoid improper escaping and execution issues.
diff --git a/app/page.tsx b/app/page.tsx
index c9897a4..0efa3da 100644
--- a/app/page.tsx
+++ b/app/page.tsx
@@ -17,9 +17,7 @@ const JSON_LD_STRING = safeJsonLdStringify(JSON_LD);
 export default function Page() {
   return (
     <div className="flex flex-col gap-20 pb-20">
-      <script type="application/ld+json">
-        {JSON_LD_STRING}
-      </script>
+      <script type="application/ld+json" dangerouslySetInnerHTML={{ __html: JSON_LD_STRING }} />
       <Hero />
       <Features />
     </div>