Closed LucaCinquini closed 7 years ago
Who: NOAA security scan
CoG wiki pages are currently allowed (through CKEditor) to embed tags such as , <form> and <script>, which can be used maliciously.</p> </div> </div> <div class="comment"> <div class="user"> <a rel="noreferrer nofollow" target="_blank" href="https://github.com/LucaCinquini"><img src="https://avatars.githubusercontent.com/u/637059?v=4" />LucaCinquini</a> commented <strong> 7 years ago</strong> </div> <div class="markdown-body"> <p>Not any more - the wiki update is now rejected if any of these tags is found.</p> </div> </div> <div class="comment"> <div class="user"> <a rel="noreferrer nofollow" target="_blank" href="https://github.com/murphysj"><img src="https://avatars.githubusercontent.com/u/1512704?v=4" />murphysj</a> commented <strong> 7 years ago</strong> </div> <div class="markdown-body"> <p>I added a period to the warning plus the following sentence:</p> <p>"Use the source button to remove."</p> <p>Sometime, these tags get added when a user copies and pastes content and they may not have done purpose. </p> </div> </div> <div class="comment"> <div class="user"> <a rel="noreferrer nofollow" target="_blank" href="https://github.com/murphysj"><img src="https://avatars.githubusercontent.com/u/1512704?v=4" />murphysj</a> commented <strong> 7 years ago</strong> </div> <div class="markdown-body"> <p>verified on cu dev. </p> </div> </div> <div class="page-bar-simple"> </div> <div class="footer"> <ul class="body"> <li>© <script> document.write(new Date().getFullYear()) </script> Githubissues.</li> <li>Githubissues is a development platform for aggregating issues.</li> </ul> </div> <script src="https://cdn.jsdelivr.net/npm/jquery@3.5.1/dist/jquery.min.js"></script> <script src="/githubissues/assets/js.js"></script> <script src="/githubissues/assets/markdown.js"></script> <script src="https://cdn.jsdelivr.net/gh/highlightjs/cdn-release@11.4.0/build/highlight.min.js"></script> <script src="https://cdn.jsdelivr.net/gh/highlightjs/cdn-release@11.4.0/build/languages/go.min.js"></script> <script> hljs.highlightAll(); </script> </body> </html>
Who: NOAA security scan
CoG wiki pages are currently allowed (through CKEditor) to embed tags such as