search

mstone / atlas

an experimental wiki intended to explore low-latency search, editing, and mapping of the kinds of boundary objects found in complex sociotechnical systems
BSD 3-Clause "New" or "Revised" License
5 stars 1 forks source link

svg-edit XSS? #1

Open mstone opened 10 years ago

mstone commented 10 years ago

There are lots of ways to include javascript in SVG but atlas does not yet make any attempt to protect its users from dangerous SVG.

(For what it's worth, this will almost certainly require parsing and whitelisting to fix, given the diversity of known JS inclusion paths including script elements, via CSS, via xinclude, and probably via svg:image.)

zenhack commented 9 years ago

The python feedparser library's whitelist might provide a good starting point: http://pythonhosted.org/feedparser/html-sanitization.html