Found a bug of html injection case.

hinesboy / mavonEditor

mavonEditor - A markdown editor based on Vue that supports a variety of personalized features

http://www.mavoneditor.com/

MIT License

6.45k stars 918 forks source link

Open fofofofoxier opened 5 years ago

fofofofoxier commented 5 years ago

The editor alerts a prompt if type in such content:"<img src=x onerror=prompt(/joker/);>"

fofofofoxier commented 5 years ago

BTW, the phenomenon of html inject is quite terrible, I tryed typing in html tags with on* properties, the js always runs