Preview Panel XSS with img tags

[perryflynn]

It is possible to inject a XSS into the preview panel because it's renders HTML:

<img src="la" onerror="alert('hi');">

Reproducable on http://lon-yang.github.io/markdown-editor/

[instance-oom]

You can change this option(markedjsOpt.sanitize) to true to prevent. e.g.

options = {
  markedjsOpt: {
    sanitize: true
  }
}

<md-editor [options]="options"></md-editor>

[perryflynn]

If true, sanitize the HTML passed into markdownString with the sanitizer function. Warning: This feature is deprecated and it should NOT be used as it cannot be considered secure. Instead use a sanitize library, like DOMPurify (recommended), sanitize-html or insane on the output HTML!

https://marked.js.org/using_advanced#options

Is it possible to just run the Angular sanirize function on the markdown code first and then parse the markdown?

https://angular.io/api/platform-browser/DomSanitizer#sanitize

[instance-oom]

I will try this or just using DOMPurify, then override the sanitize option

[instance-oom]

Solved