search

ari / jobsworth

Project Management, Collaboration and Time Tracking.
GNU Affero General Public License v3.0
640 stars 197 forks source link

Cross-Site Scripting Warning in app/views/snippets/show.html.erb #654

Open ari opened 7 years ago

ari commented 7 years ago

Security issue from Hakiri: Unescaped model attribute in app/views/snippets/show.html.erb

k41n commented 7 years ago

We can use http://apidock.com/rails/ActionView/Helpers/SanitizeHelper/sanitize to aviod this issue. But it can hide some parts of bodies for existing snippets, for example or [some URL] on snippet view page. We can customize it, but need to define white list for tags. @ari

ari commented 7 years ago

Isn't this the same problem we have in task comments? Why aren't we getting an error there?

At any rate, I'd like to move to markdown for comment text (with some extensions of our own like #1234 task links). I guess we'll need to think about incoming text from emails too, but hopefully markdown will cope with that.