Caption contents allows un-sanatized HTML

fedwiki / wiki-plugin-video

Embed Video from YouTube or Vimeo

Other

3 stars 5 forks source link

Caption contents allows un-sanatized HTML #8

Closed paul90 closed 9 years ago

paul90 commented 9 years ago

It is possible to include HTML in a video's caption.

WardCunningham commented 9 years ago

Hmm. It should use the same simple and blunt escapes as paragraph. Maybe escaping should be built into resolving or something like it.

WardCunningham commented 9 years ago

My search shows that seven plugins render text with wiki.resolvLinks.

chart (caption)
data (text)
efficiency (text)
federatedWiki (title, text)
logwatch (title, listeners)
map (text)
mathjax (text)

WardCunningham commented 9 years ago

My search show that eleven plugins render from item.text without resolving links. Many of these pass text through regular expressions which can be safe when done carefully. Several embed text directly in dom elements. Yuck.

bytebeat (colorCode)
calculator (regex)
calendar (parse)
code (prettyPrintOne, escape)
linkmap (regex)
metabolism (regex)
method (regex)
pagefold
radar (parseText)
reduce (regex)
txtzyme

paul90 commented 9 years ago

fixed by #10