Pull Request: Fix Client-Side XSS Sanitization Race Condition & Resolve Build Errors

[tejask011]

Pull Request: Fix Client-Side XSS Sanitization Race Condition & Resolve Build Errors

📝 Description

---

Closes #138

🔒 Security Fix

Fixed a client-side race condition in src/lib/security/sanitize.ts where isomorphic-dompurify was loaded asynchronously. If sanitizeAIResponse(html) executed before the import completed, it fell back to a basic regex, leaving the application vulnerable to XSS through tags like <img>, <svg>, and <iframe>.

🛠️ Changes

• Replaced the async import() with a synchronous require() inside typeof window !== "undefined" to ensure DOMPurify is available immediately on the client.
• Preserved server-side safety by keeping the browser check to avoid SSG/JSDOM issues.
• Fixed build and lint errors:
  • Replaced any[] with unknown[] and updated withAuth return types to Promise<Response>.
  • Restored compatible Tailwind types for addComponents and addUtilities.

---

🧪 Testing

✅ Jest Tests

Test Suites: 26 passed, 26 total
Tests:       299 passed, 299 total

✅ Production Build

✓ Compiled successfully
✓ Linting and type checking passed
✓ Static pages generated successfully

---

📦 Type of Change

• Bug fix
• Security fix
• Code cleanup / lint fixes

SSOC '26

[vercel]

@tejask011 is attempting to deploy a commit to the Smrithi P's projects Team on Vercel.

A member of the Team first needs to authorize it.

[smrithipiedy]

Hi @tejask011, thank you for your contribution. Please make sure to star this repo!