418sec / huntr

Public Roadmap | huntr.dev
https://huntr.dev
263 stars 89 forks source link

Sanitization in Comment section seems to be performing wrong operation #2081

Closed B3EF closed 3 years ago

B3EF commented 3 years ago

while pasting or adding code in the code pamphlet of markdown in the comment section , the input sanitize function present there is removing the code from the pamphlet ; i was trying to comment this

<image x="10" y="10" width="276" height="110" xlink:href="http://0a0fdf524388.ngrok.io"/>
<path d="M0 150h300v10H0z"/>
</svg> 

and after submitting i have got this

adam-nygate commented 3 years ago

Hey @B3EF,

I'm not sure if I see the issue. When testing your message, it renders like this:

image

Could you highlight what's missing?

B3EF commented 3 years ago

sorry i have pasted the wrong content

<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" style="position:relative" width="300" height="200" overflow="hidden">
<image x="10" y="10" width="276" height="110" xlink:href="https://en7uzqeqppd0apu.m.pipedream.net"/>
<path d="M0 150h300v10H0z"/>
</svg>
B3EF commented 3 years ago

this was the content I was trying to include

adam-nygate commented 3 years ago

This is what I get:

image
B3EF commented 3 years ago

Screenshot from 2021-07-15 17-06-30 but i am getting this did you have tried pasting it inside ```

B3EF commented 3 years ago

let me check whether its my browsers issue too

B3EF commented 3 years ago

Screenshot from 2021-07-15 17-12-14 tried with a different browser too.

adam-nygate commented 3 years ago

It's because the markdown is incorrectly formatted, you must use a newline after each ```, e.g:

\```
<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" style="position:relative" width="300" height="200" overflow="hidden">
<image x="10" y="10" width="276" height="110" xlink:href="https://en7uzqeqppd0apu.m.pipedream.net"/>
<path d="M0 150h300v10H0z"/>
</svg>
\```

(without the preceding \'s)

B3EF commented 3 years ago

oh ok thanks for the help

adam-nygate commented 3 years ago

No worries :)