An XSS vulnerability is present in the Markdown component, where unsanitized user input is directly passed into dangerouslySetInnerHTML. For more info, refer to here.
Note: The changes in UI test snapshots are merely the order of the a tag attributes - they are essentially the same.
Type of change
[x] Bug fix (non-breaking change which fixes an issue)
[ ] New feature (non-breaking change which adds functionality)
[ ] Breaking change (fix or feature that would cause existing functionality to not work as expected)
[ ] This change requires a documentation update
[ ] Code quality improvements
How to test
An example would be entering the text <img src="" onerror={alert('xss')} /> in the "Module Help Text" of the Admin Panel page when creating a new course. After sanitization, the alert('xss') command should not be run.
Description
An XSS vulnerability is present in the
Markdown
component, where unsanitized user input is directly passed intodangerouslySetInnerHTML
. For more info, refer to here.Note: The changes in UI test snapshots are merely the order of the
a
tag attributes - they are essentially the same.Type of change
How to test
An example would be entering the text
<img src="" onerror={alert('xss')} />
in the "Module Help Text" of the Admin Panel page when creating a new course. After sanitization, thealert('xss')
command should not be run.Checklist