Escape HTML while parsing Markdown documents to remove XSS vulnerabilities #4
Loading…
Reference in New Issue
No description provided.
Delete Branch "fix-xss-vulnerability"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Here, I opted to use the Markdown parser's detection of HTML so that we don't add another library. This does limit users somewhat, because it means that no inline HTML is allowed, but I think this is acceptable: this is a platform for project management, not general-purpose publishing, so inline HTML is probably not necessary. There is a clear upgrade path in the future to add sanitizing instead of escaping tags, if we want.
This approach also gives us a clear place to plug in detection of extra things, like custom
@
tags or other features.