diy / jquery-emojiarea

A rich textarea control that supports emojis, WYSIWYG-style.
298 stars 87 forks source link

Security issue #14

Open beeseenmedia opened 8 years ago

beeseenmedia commented 8 years ago

I am not sure how this plug in works honestly, but lets say you have

if you set value to be <script>alert("test");</script> which is a script code but encoded to prevent js injection, then it gets transformed and excecuted, this one just alerts test.

I have made a fiddle as proof https://jsfiddle.net/1tkpcjbq/