search

miromannino / Justified-Gallery

Javascript library to help creating high quality justified galleries of images. Used by thousands of websites as well as the photography community 500px.
http://miromannino.github.io/Justified-Gallery/
MIT License
1.68k stars 299 forks source link

Add option for XSS filtering of caption content #265

Closed seanbeaton closed 5 years ago

seanbeaton commented 6 years ago

I've covered the reasons for this in the closed task #47.

I'll copy-paste my comments below. There's also a pull request for this, #264.

seanbeaton commented 6 years ago

We're having this same issue, but with JS. We're already escaping the alt tag's content before it's added to the page with JS, but we want the content of the alt tag to be readable (and we don't want to double-escape its content). Also, we don't need to use JS inside the tag for things like Like buttons and such.

I've created a pull request that adds a setting escapeCaptionMarkup to the settings array. It defaults to false, but setting it to true will use a different method of adding the caption text that doesn't run JS.

Just as a note to why this addition is important - sometimes we we're allowing user content in the alt attribute, making this an XSS risk.

As of now, the default setting keeps the current functionality (no filtering), but it may be worth looking at having the default be safer and use the true or 'lenient' option to guard against accidental XSS vulnerabilities. This would change functionality for people intentionally using JS in their captions (for like buttons and such), so it would need to be a separate version with documentation of the change for anyone upgrading.