alphagov / specialist-publisher

Publishes specialist documents on GOV.UK
https://docs.publishing.service.gov.uk/apps/specialist-publisher.html
MIT License
10 stars 7 forks source link

[CLOSED] Restrict allowed image hosts #232

Closed benilovj closed 8 years ago

benilovj commented 8 years ago

Issue by jamiecobbett Wednesday 20 August 2014 at 16:22 GMT Originally opened as https://github.com/alphagov/specialist-publisher/pull/232


This prevents images not hosted by us from being included in content on GOV.UK by content editors or an attacker who has gained control of an editor's account. Such images could be altered to something malicious (or a trollface) at the whim of the website owner or an attacker who gains control of that domain.

This is provided by version 19.0.0 of govuk_content_models.

See also: https://github.com/alphagov/publisher/pull/247 and https://github.com/alphagov/govuk_content_models/pull/220


jamiecobbett included the following code: https://github.com/alphagov/specialist-publisher/pull/232/commits

benilovj commented 8 years ago

Comment by bestie Thursday 21 August 2014 at 09:38 GMT


So gov.uk will have to host a gif library then?