Dashboard site being flagged as unsafe by Google Safe Browsing

thedrew · September 6, 2022, 10:16pm

I created an issue and PR:

github.com/parse-community/parse-dashboard

App.js does not produce valid html

opened 10:03PM - 06 Sep 22 UTC

closed 07:13PM - 08 Sep 22 UTC

andrew-polk

type:bug

### New Issue Checklist  - [x] I am not disclosing a [vulnerability](https://github.com/parse-community/parse-server/blob/master/SECURITY.md). - [x] I am not just asking a [question](https://github.com/parse-community/.github/blob/master/SUPPORT.md). - [x] I have searched through [existing issues](https://github.com/parse-community/parse-dashboard/issues?q=is%3Aissue). - [x] I can reproduce the issue with the latest versions of [Parse Server](https://github.com/parse-community/parse-server/releases) and [Parse Dashboard](https://github.com/parse-community/parse-dashboard/releases). ### Issue Description App.js produces invalid html. The opening html tag is after the head and the title tag is outside the head. We suspect this led to our site being flagged by Google as being hacked or containing social engineering content. See https://community.parseplatform.org/t/dashboard-site-being-flagged-as-unsafe-by-google-safe-browsing/2872/7. ### Steps to reproduce Start up parse dashboard. On either the login page or main dashboard page, get the root html document and run it through an html validator. ### Actual Outcome ``` <!DOCTYPE html> <head> <link rel="shortcut icon" type="image/x-icon" href="/dashboard/favicon.ico" /> <base href="/dashboard/"/> <script> PARSE_DASHBOARD_PATH = "/dashboard/"; </script> </head> <html> <title>Parse Dashboard</title> <body> <div id="browser_mount"></div> <script src="/dashboard/bundles/dashboard.bundle.js"></script> </body> </html> ``` ### Expected Outcome ``` <!DOCTYPE html> <html> <head> <link rel="shortcut icon" type="image/x-icon" href="/dashboard/favicon.ico" /> <base href="/dashboard/"/> <script> PARSE_DASHBOARD_PATH = "/dashboard/"; </script> <title>Parse Dashboard</title> </head> <body> <div id="browser_mount"></div> <script src="/dashboard/bundles/dashboard.bundle.js"></script> </body> </html> ``` ### Environment Dashboard - Parse Dashboard version: `4.1.4` - Browser (Safari, Chrome, Firefox, Edge, etc.): `any (I used Chrome)` - Browser version: `105` Server - Parse Server version: `any (irrelevant)` - Operating system: `Windows` - Local or remote host (AWS, Azure, Google Cloud, Heroku, Digital Ocean, etc): `local (any)` Database - System (MongoDB or Postgres): `MongoDB` - Database version: `irrelevant` - Local or remote host (MongoDB Atlas, mLab, AWS, Azure, Google Cloud, etc): `local (any)` ### Logs n/a

github.com/parse-community/parse-dashboard

fix: dashboard contains invalid html for top-level document

parse-community:alpha ← andrew-polk:ValidHtml

opened 10:07PM - 06 Sep 22 UTC

andrew-polk

+16 -16

### New Pull Request Checklist  - [x] I am not disclosing a [vulnerability](https://github.com/parse-community/parse-server/blob/master/SECURITY.md). - [x] I am creating this PR in reference to an [issue](https://github.com/parse-community/parse-dashboard/issues?q=is%3Aissue). ### Issue Description Fixes html for top-level document to be valid. Related issue: #2253 ### Approach Fix html tag ordering to be valid html. ### TODOs before merging  - [x] A changelog entry is created automatically using the pull request title (do not manually add a changelog entry)