Escape HTML while parsing Markdown documents to remove XSS vulnerabilities #4

Merged

nicole merged 1 commits from fix-xss-vulnerability into main

2024-06-03 18:15:53 +00:00

nicole commented

2024-06-03 18:15:46 +00:00

Owner

Here, I opted to use the Markdown parser's detection of HTML so that we don't add another library. This does limit users somewhat, because it means that no inline HTML is allowed, but I think this is acceptable: this is a platform for project management, not general-purpose publishing, so inline HTML is probably not necessary. There is a clear upgrade path in the future to add sanitizing instead of escaping tags, if we want.

This approach also gives us a clear place to plug in detection of extra things, like custom @ tags or other features.

Here, I opted to use the Markdown parser's detection of HTML so that we don't add another library. This does limit users somewhat, because it means that *no* inline HTML is allowed, but I think this is acceptable: this is a platform for project management, not general-purpose publishing, so inline HTML is probably not necessary. There is a clear upgrade path in the future to add sanitizing instead of escaping tags, if we want. This approach also gives us a clear place to plug in detection of extra things, like custom `@` tags or other features.

nicole added 1 commit 2024-06-03 18:15:47 +00:00