Conversation
|
|
||
| export const WrappedMarkdown = ({ text }: WrappedMarkdownProps) => { | ||
| const cleanText = text | ||
| .replace(/<\/?script>/g, 'Naughty!') |
There was a problem hiding this comment.
This seems quite permissive as sanitization - does it work with newline/null char injection etc? Are there any other filter evasion techniques we could nix with this (I'm guessing we're limited in sanitization due to it being html content)
There was a problem hiding this comment.
I've done some more read-around on the component, and I can explicitly block tags and their content a lot more easily than I did here. For the most part it's not that big an issue - we're not allowing direct use of html in the editor for one - so this is more an emergency backstop in case someone does an API intercept.
There was a problem hiding this comment.
Is it worth just throwing a big old list of XSS attacks at the function and seeing what happens? There's a few example repos out there with various lists of attacks, e.g. this one
3 participants
Issues affected
Closes #29, #22, #31, #32, #33, #34
Description
I forgot to stop. A fairly large chunk of the input form components, plus some more basic page chrome, plus the Markdown-out component.
How to test
Run up Storybook and poke around. There are also a few unwired auth pages to look at.
Screenshots
Any other information?
Checklist