Fields using HTML should have some sort of XSS protection - Githubissues

gathering / unicorn-backend

Backend/API for UNICORN

https://competitions.gathering.org

MIT License

2 stars 1 forks source link

Fields using HTML should have some sort of XSS protection #3

Open eriktm opened 3 years ago

eriktm commented 3 years ago

Proposed Functionality

Fields that contains data should have some sort of XSS protection. This would usually be something that removes illegal tags and attributes.

Known fields that use HTML are the description and rules fields in Competition, with more to come.

Use Case

Improved protection against XSS attacks

Database Changes

None

External Dependencies

Possibly html-sanitizer