search

cylc / cylc-ui

Web app for monitoring and controlling Cylc workflows
https://cylc.github.io
GNU General Public License v3.0
37 stars 27 forks source link

markdown: use component where possible #875

Open oliver-sanders opened 2 years ago

oliver-sanders commented 2 years ago

We are internally processing markdown for mutations.

We then inject this HTML code into the relevant component dynamically.

Security scanners don't like this as it looks like potential code injection. There is another way that is slightly nicer to use an intermediate component.

_Originally posted by @wxtim in https://github.com/cylc/cylc-ui/pull/874#discussion_r782035652_

oliver-sanders commented 2 years ago

Note we have since changed markdown parser. Need to check the code to see whether we have any markdown parsing which isn't going through this interface.