search

jnf / blinder

We use Blinder to collect and review responses to event RFPs.
MIT License
6 stars 8 forks source link

HTML and JS are interpreted in form submission #39

Closed jeanlange closed 10 years ago

jeanlange commented 10 years ago

Maybe we should allow Markdown? Or maybe nothing at all.

Here were my experiences with using HTML and JS: I did something awful to it at about 8:07 this morning when I pasted the source of the page into one of the other boxes. So it can be broken. What happened when I did that and submitted is that I got back a page that said 'data:,' in the URL and had no source. Pressing back and removing the source of the page fixed my issue - I was then able to submit. It kept my text when I pressed 'back' but lost my radio button settings.

When I submitted for real, my HTML in the title got interpreted, including my unclosed tag, on the confirmation page. My unclosed tag was sort of fixed in the email I got sent - it only affected the rest of the title, not the entirety of the email. I will attempt with JS next. - JS also gets interpreted.

jnf commented 10 years ago

I will totally go with majority opinion here. Easy enough to simply not interpret tags. Easy enough to implement markdown. Harder to strip tags, but doable.

Thoughts?

jnf commented 10 years ago

I implemented Markdown in #55. I'm pretty ok with all of it. Closing this for now so I can focus on other stuff, but will revisit in a hurry if issues/abuse arises.