search

haru / redmine_wiki_extensions

58 stars 30 forks source link

prevent possible JS injection in foot note macro #31

Open jkraemer opened 2 years ago

jkraemer commented 2 years ago

the footnote macro currently does not escape the description argument, which allows a malicious user to insert any javascript code into a page:

{{fn(word, <script>alert('foobar');</script>)}}
jkraemer commented 2 years ago

second commit fixes a similar problem in the div macro where one could break out of the attributes of the div tag with specially crafted argument values.

codeclimate[bot] commented 2 years ago

Code Climate has analyzed commit fc8245ad and detected 0 issues on this pull request.

View more on Code Climate.