slotlist / slotlist-backend

Backend of slotlist.info, an ArmA 3 mission planning and slotlist management tool
https://slotlist.info
MIT License
14 stars 6 forks source link

Sanitize HTML entered by user in editor/descriptions #11

Closed MorpheusXAUT closed 7 years ago

MorpheusXAUT commented 7 years ago

Since many fields (especially in the mission details) allow for content to be displayed as HTML, we have to add HTML sanitizing to prevent malicious code being executed or user information stolen via mission descriptions or likewise.

An example package for achieving this would be sanitize-html.

This should definitely be added before the beta version of slotlist.info goes live and users start creating custom missions.


Tasks

MorpheusXAUT commented 7 years ago

It looks like some sort of sanitization is already done, presumably by the quill editor or vue... A few tests were not able to run any alerts or logs, so it might be enough already. This will need to be monitored though...

Postponed for now.

MorpheusXAUT commented 7 years ago

Sinus wasn't able to trigger any sort of vulnerability by manually spamming the site with garbage data or common attacks. This issue will be closed for now, since it appears the site is secure enough.