search

blossom-editor / blossom

A markdown editor that you can deploy on your own servers to achieve cloud storage and device synchronization（支持私有部署的云端存储双链笔记软件）
https://www.wangyunf.com/blossom-doc/index
MIT License
2.97k stars 231 forks source link

blossom 存在存储型 XSS 漏洞 #121

Closed Guardian-JTZ closed 2 months ago

Guardian-JTZ commented 4 months ago

介绍

blossom 提供了一个默认的编辑器, 但是我发现其提供的编辑器对于用户编写的一些恶意的内容会导致其触发 XSS 漏洞, 恶意用户可以利用此来进行钓鱼活动以及其他活动

示例

<img src=x onerror="alert(1)">

image-20240511183645317

修复

经过测试, 发现此编辑器基本没有进行任何 XSS 的防护, 建议使用 XSS 防护插件对用户提交的所有内容都进行过滤, 或者使用白名单限制用户可以使用哪些标签比如 p a 并限制 JS 函数

github-actions[bot] commented 3 months ago

This issue has been open 30 days with no activity. This will be closed in 7 days.

github-actions[bot] commented 2 months ago

This issue has been automatically marked as stale because it hasn't had any recent activity.