From 2bca4dc87b0b243b677d201a1cf29b9bb677e891 Mon Sep 17 00:00:00 2001
From: soonnae <ohjeongmin9@gmail.com>
Date: Fri, 1 Aug 2025 01:32:53 +0900
Subject: [PATCH 1/3] [ AutoFiC ] Create package.json and CI workflow

---
 .github/workflows/pr_notify.yml | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)
 create mode 100644 .github/workflows/pr_notify.yml

diff --git a/.github/workflows/pr_notify.yml b/.github/workflows/pr_notify.yml
new file mode 100644
index 0000000..2b34036
--- /dev/null
+++ b/.github/workflows/pr_notify.yml
@@ -0,0 +1,20 @@
+name: PR Notifier
+
+on:
+  pull_request:
+    types: [opened, reopened, closed]
+
+jobs:
+  notify:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Notify Discord
+        env:
+          DISCORD_WEBHOOK_URL: ${{ secrets.DISCORD_WEBHOOK_URL }}
+        run: |
+          curl -H "Content-Type: application/json"           -d '{"content": "🔔 Pull Request [${{ github.event.pull_request.title }}](${{ github.event.pull_request.html_url }}) by ${{ github.event.pull_request.user.login }} - ${{ github.event.action }}"}'           $DISCORD_WEBHOOK_URL
+      - name: Notify Slack
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
+        run: |
+          curl -H "Content-Type: application/json"           -d '{"text": ":bell: Pull Request <${{ github.event.pull_request.html_url }}|${{ github.event.pull_request.title }}> by ${{ github.event.pull_request.user.login }} - ${{ github.event.action }}"}'           $SLACK_WEBHOOK_URL

From 34cbccfcf93695b6d18d19889cb52579d812317c Mon Sep 17 00:00:00 2001
From: soonnae <ohjeongmin9@gmail.com>
Date: Fri, 1 Aug 2025 01:32:56 +0900
Subject: [PATCH 2/3] [ AutoFiC ] 2 malicious code detected!!

---
 src/components/Content.js | 3 ++-
 src/components/Schema.js  | 3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/src/components/Content.js b/src/components/Content.js
index f605c71..55b543d 100644
--- a/src/components/Content.js
+++ b/src/components/Content.js
@@ -1,6 +1,7 @@
 import React from 'react'
 import Marked from 'react-markdown'
 import PropTypes from 'prop-types'
+import DOMPurify from 'dompurify' // Import DOMPurify
 
 import { getImageSrc, getImageSrcset } from '../util/getImageUrl'
 import './Content.css'
@@ -33,7 +34,7 @@ const HtmlBlock = ({ value }) => {
     <div
       className={`Content--Iframe`}
       dangerouslySetInnerHTML={{
-        __html: value
+        __html: DOMPurify.sanitize(value) // Sanitize the HTML content
       }}
     />
   )
diff --git a/src/components/Schema.js b/src/components/Schema.js
index fab652b..abb1710 100644
--- a/src/components/Schema.js
+++ b/src/components/Schema.js
@@ -1,5 +1,6 @@
 import React from 'react'
 import PropTypes from 'prop-types'
+import DOMPurify from 'dompurify';
 
 const Schema = ({
   name,
@@ -32,7 +33,7 @@ const Schema = ({
   return (
     <script
       type='application/ld+json'
-      dangerouslySetInnerHTML={{ __html: JSON.stringify(data) }}
+      dangerouslySetInnerHTML={{ __html: DOMPurify.sanitize(JSON.stringify(data)) }}
     />
   )
 }

From f8ef67ad883fa48a696892708e917db0686c74e6 Mon Sep 17 00:00:00 2001
From: soonnae <ohjeongmin9@gmail.com>
Date: Fri, 1 Aug 2025 01:33:12 +0900
Subject: [PATCH 3/3] chore: remove CI workflow before upstream PR

---
 .github/workflows/pr_notify.yml | 20 --------------------
 1 file changed, 20 deletions(-)
 delete mode 100644 .github/workflows/pr_notify.yml

diff --git a/.github/workflows/pr_notify.yml b/.github/workflows/pr_notify.yml
deleted file mode 100644
index 2b34036..0000000
--- a/.github/workflows/pr_notify.yml
+++ /dev/null
@@ -1,20 +0,0 @@
-name: PR Notifier
-
-on:
-  pull_request:
-    types: [opened, reopened, closed]
-
-jobs:
-  notify:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Notify Discord
-        env:
-          DISCORD_WEBHOOK_URL: ${{ secrets.DISCORD_WEBHOOK_URL }}
-        run: |
-          curl -H "Content-Type: application/json"           -d '{"content": "🔔 Pull Request [${{ github.event.pull_request.title }}](${{ github.event.pull_request.html_url }}) by ${{ github.event.pull_request.user.login }} - ${{ github.event.action }}"}'           $DISCORD_WEBHOOK_URL
-      - name: Notify Slack
-        env:
-          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
-        run: |
-          curl -H "Content-Type: application/json"           -d '{"text": ":bell: Pull Request <${{ github.event.pull_request.html_url }}|${{ github.event.pull_request.title }}> by ${{ github.event.pull_request.user.login }} - ${{ github.event.action }}"}'           $SLACK_WEBHOOK_URL