search

freedomofpress / securethenews

An automated scanner and web dashboard for tracking TLS deployment across news organizations
https://securethe.news
GNU Affero General Public License v3.0
102 stars 25 forks source link

Update markdown #153

Closed harrislapiroff closed 6 years ago

harrislapiroff commented 6 years ago

From safety:

-> markdown2, installed 2.3.4, affected <2.3.5, id 35760 An issue was discovered in markdown2 (aka python-markdown2) through 2.3.5. The safe_mode feature, which is supposed to sanitize user input against XSS, is flawed and does not escape the input properly. With a crafted payload, XSS can be triggered, as demonstrated by omitting the final '>' character from an IMG tag.

CI requires us to update this to pass

conorsch commented 6 years ago

Working on this...