search

DavidMStraub / gramps-webapp

Genealogical progressive web app based on Gramps
GNU General Public License v3.0
18 stars 4 forks source link

Escape unwanted tags #22

Closed DavidMStraub closed 4 years ago

DavidMStraub commented 4 years ago

To prevent possible Javascript code injection, unwanted tags should be filtered out from the body of notes.

All other text fields should probably be stripped of all tags.

DavidMStraub commented 4 years ago

This turned out to be simpler than assumed since, except for the note content, there is no usage of innerHTML in the frontend, and lit-element is (mostly) safe from XSS thanks to HTML templating.

Thus, solved by 6f07892.