search

Kholid060 / MkDown2

Online markdown editor
https://mkdown.vercel.app
MIT License
129 stars 21 forks source link

[Suggestion] Patch XSS #178

Closed ahsan-a closed 3 years ago

ahsan-a commented 3 years ago

Inputting something along the lines of:

<img src=x onerror="alert('xss test')"/>

would make the JS in onerror execute. There's a couple of libraries to patch this, such as DOMPurify. However, it's up to you whether you reckon this is necessary. The XSS wouldn't harm anyone as the input field is only accessible by the current user. However, it could be something you may want to consider patching.

Cool editor btw! I've switched from stackedit to this.

Kholid060 commented 3 years ago

Sorry for the late reply, and thank you for your suggestion. I have fixed the XSS issue in 49ed89cc8e256897a5ee3a650f128fc488adf96c