Open mvolz opened 4 years ago
This isn't really something we can fix generally, but I've committed a change that, when paired with an updated EM translator, will mostly fix the above example. We can't fully emulate innerText
in the browser, because it's not supported by JSDOM, but we can at least exclude script
and style
content when doing fallback author parsing (i.e., elements with byline
or vcard
classes, which have no actual meaning but usually indicate the presence of an author).
Note that this isn't really a security issue in any general sense. The issue here is just junk data in creator entries — what exactly it is shouldn't matter. translation-server returns text, not code. If it's being inserted into an HTML document, it should be properly escaped, as with any other untrusted input. (The one exception might be the few tags allowed by Zotero/citeproc-js, which it's possible some translators include in returned data, but that would be a strict whitelist.)
curl -d 'https://www.milliyet.com.tr/gundem/canan-dagdeviren-kimdir-2392696' -H 'Content-Type: text/plain' http://127.0.0.1:1969/web
gives the results
This is a security issue we automatically block the edit, but it's not ideal.
I think I brought this up before, years ago, and it was recommended I file a bug in the translators repo instead, but I really think this is something that should be protected against here ideally as well! Bug for translators lib here: https://github.com/zotero/translators/issues/2117