search

EmurgoHK / cardanoupdate

problem: it's extremely difficult to keep up with everything happening within the Cardano ecosystem
http://cardanoupdate.space
Mozilla Public License 2.0
12 stars 21 forks source link

problem: security vulnerability found #569

Closed gsovereignty closed 5 years ago

gsovereignty commented 5 years ago

problem: screenshot 2018-11-22 at 4 22 09 pm

porcellus commented 5 years ago

As there are no patched versions we can't really fix this ourselves (besides fixing it in a fork and sending a PR). What we could do is to move over to another library, e.g.: editor.md. We can implement something like this example https://pandao.github.io/editor.md/examples/custom-toolbar.html

anbud commented 5 years ago

Hmm, looking at the simplemde repo, it seems abandoned. Maybe we should migrate to editor.md.

But, there's another, simpler fix to this one. This comment says that adding sanitize: true to our markdown processor should fix the given problem.

gsovereignty commented 5 years ago

It's up to you guys, both look about equally simple solutions. If you think it's a worthwhile project just fork it under emurgohk and apply the C4 to it, I have a quick guide here: http://socialarchitecture.science/forking-an-open-source-repository/ (skip to the part about forking).

porcellus commented 5 years ago

I don't think it's worthwhile (at least not because of this). I'll test if sanitize fixes it and migrate to editor.md otherwise. @emurgobot claim

porcellus commented 5 years ago

It worked, good catch @anbud @emurgobot done in #574