search

UltimateHackingKeyboard / agent

Ultimate Hacking Keyboard configurator
https://ultimatehackingkeyboard.github.io/agent/
Other
702 stars 77 forks source link

html links in keymap description can lead Agent astray #2335

Closed mhantsch closed 1 month ago

mhantsch commented 2 months ago

Add some funky html in the keymap description:

image

See that it looks awesome:

image

Click on the github link, and watch Agent turn into a new web page:

image

No way to get back to Agent 😏 You have to close the window and restart Agent.

You could filter out all html content, but it's kind of nice that I can do tables and bold emphasis etc...

mhantsch commented 2 months ago

And yes, of course I can add target="_blank" to the link and it will open in a new window and leave Agent intact.

mondalaci commented 2 months ago

Thanks for the report! From a security standpoint, I think Agent should escape all HTML.

mhantsch commented 2 months ago

From a security standpoint, I think Agent should escape all HTML.

There goes my table... 😔😉

Unfortunately, I agree to the security reasoning.

ert78gb commented 1 month ago

The #2352 PR sanitize the full HTML content but I maybe would better UX to define which HTML elements are allowed and open URLs in the external browser. But do it in other issue if there is user need.

mondalaci commented 1 month ago

Let's allow the use of newlines instead of converting them to <br>

mhantsch commented 1 month ago

snif

image

Can confirm this is now working as intended. Table, emphasis and links are now gone.