From 5a630659e2be23deb25a2e656ae04580f8c00133 Mon Sep 17 00:00:00 2001 From: Nicole Tietz-Sokolskaya Date: Mon, 3 Jun 2024 14:12:51 -0400 Subject: [PATCH] Escape HTML in output so that we don't have XSS vulnerabilities --- src/models/documents.rs | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/src/models/documents.rs b/src/models/documents.rs index 5674e8a..40ca3f5 100644 --- a/src/models/documents.rs +++ b/src/models/documents.rs @@ -25,8 +25,21 @@ impl Document { let parser = markdown::Parser::new_ext(&self.content, options); + // If we just process things as they are, we are vulnerable to XSS + // attacks, since users can inject any HTML they'd like. To prevent + // this, we convert any parsed HTML to just text. In the future, we can + // instead sanitize the HTML using something like + // [ammonia](https://crates.io/crates/ammonia) to make the HTML safer. + // Draws inspiration from + // [pulldown-cmark/pulldown-cmark#608](https://github.com/pulldown-cmark/pulldown-cmark/issues/608) + let escaped = parser.into_iter().map(|event| match event { + markdown::Event::Html(html) => markdown::Event::Text(html), + markdown::Event::InlineHtml(html) => markdown::Event::Text(html), + _ => event, + }); + let mut html_output = String::new(); - markdown::html::push_html(&mut html_output, parser); + markdown::html::push_html(&mut html_output, escaped); html_output }