Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Vulnerable to Self-XSS #226

Closed
NateScarlet opened this issue Mar 19, 2020 · 6 comments
Closed

Vulnerable to Self-XSS #226

NateScarlet opened this issue Mar 19, 2020 · 6 comments
Assignees
@88250
Labels
修复缺陷
Milestone
3.1.0

Comments

@NateScarlet
Copy link
Contributor

https://en.wikipedia.org/wiki/Self-XSS
image

I tried tui.editor and stackedit, they will auto sanitize such input
@88250 88250 self-assigned this Mar 19, 2020
@88250
Copy link
Collaborator

88250 commented Mar 19, 2020

感谢反馈，确实存在安全隐患，后续会进行修复。

@Vanessa219 Vanessa219 added this to the 3.0.0 milestone Mar 19, 2020
@88250 88250 removed this from the 3.0.0 milestone Mar 20, 2020
@jakekwak
Copy link
Contributor

jakekwak commented Apr 1, 2020

option for HTML like HyperMD
html: true or false
27

@NateScarlet
Copy link
Contributor Author

Rather than turn off html completely, I prefer sanitize html with a whitelist (use library like DomPurify or xss)

@88250 88250 added this to the 3.1.0 milestone Apr 10, 2020
@88250 88250 mentioned this issue Apr 10, 2020
Closed
@88250
Copy link
Collaborator

88250 commented Apr 10, 2020

We will fix this issue in recent releases, thank you all. The main implementation will be done in Lute.

@88250 88250 closed this as completed Apr 10, 2020
@jakekwak

This comment has been minimized.

Sign in to view
@Vanessa219 Vanessa219 reopened this Apr 11, 2020
@88250 88250 mentioned this issue Apr 11, 2020
Closed
@88250
Copy link
Collaborator

88250 commented Apr 11, 2020 •
edited

Oh, it's a new issue not related to XSS fix. I created a new issue to resolve it.

@88250 88250 closed this as completed Apr 11, 2020
@88250 88250 mentioned this issue Apr 18, 2020
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@88250 88250

Labels
修复缺陷
Projects
None yet
Milestone
3.1.0
Development

No branches or pull requests
4 participants
@88250 @Vanessa219 @jakekwak @NateScarlet