search

infor-design / enterprise-ng

Angular wrappers for IDS Enterprise components
Apache License 2.0
57 stars 83 forks source link

Rich Text Editor: javascript is executed when pasted into the field #1462

Open madebyannalam opened 1 year ago

madebyannalam commented 1 year ago

Describe the bug When content containing executable javascript is pasted into a rich text field, that javascript will be executed. Doesn't happen when the same value is typed.

To Reproduce Steps to reproduce the behavior:

  1. In a rich text field that will allow copy and paste, paste in the following code: image

  2. An alert should pop up

Expected behavior The pasted content should be treated in the same manner as when it's being typed out.

Version

Screenshots screenshot-1

Platform

Additional context N/A

tmcconechy commented 1 year ago

I cant reproduce this anymore on https://main-enterprise.demo.design.infor.com/components/editor/example-index.html When i paste <img src=x onerror=alert(document.domain)> if thats correct.

Try updating to the latest as i suspect it is fixed by https://github.com/infor-design/enterprise/issues/6892

github-actions[bot] commented 5 months ago

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contribution.