Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Security] Vulnerable to XSS #249

Open
bhavinsen opened this issue Sep 10, 2021 · 7 comments
Open

[Security] Vulnerable to XSS #249

bhavinsen opened this issue Sep 10, 2021 · 7 comments

Comments

@bhavinsen
Copy link

Issue : Textarea still accepting HTML code and inline script although I have passed all props to the MDEditor component.

### snippet
<MDEditor value={editorValue} onChange={handleChange} previewOptions={{ skipHtml: true, escapeHtml: true, transformLinkUri: null, renderers, linkTarget: '_blank' }} commands={commands} />

xss

@bhavinsen bhavinsen changed the title validation on input validation on input (XSS) Sep 10, 2021
@jaywcjlove
Copy link
Member

As markdown is sometimes used for HTML, and improper use of HTML can open you up to a cross-site scripting (XSS) attack, use of remark can also be unsafe. When going to HTML, use remark in combination with the rehype ecosystem, and use rehype-sanitize to make the tree safe.

remark/readme.md#security

@bhavinsen

@bhavinsen bhavinsen changed the title validation on input (XSS) [Security] Vulnerable to XSS Sep 10, 2021
@samuelemarro
Copy link

Is there any workaround or is the only solution a pull request?

@samuelemarro
Copy link

By the way, here's the HTML from @bhavinsen 's screenshot:

<?xml version="1.0"standalone="no"?
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd"> <svg version="1.1" xmlns="http://www.w3.org/2000/svg" baseProfile="full">
<polygon id="triangle" points="0,0 0,50 50,0" fill="#009900" stroke="#004400"/>
<script type="text/javascript">
alert("hello");
</script>
</svg>

And here's a minimal working example:

<svg>
<script type="text/javascript">
alert("hello");
</script>
</svg>

@samuelemarro
Copy link

After reading the documentation it turns out that there's a simple workaround, which is adding rehype-sanitize to the editor (like @jaywcjlove suggested).
In order to do that, simply add:

import rehypeSanitize from "rehype-sanitize";

<MDEditor previewOptions={{ rehypePlugins: [rehypeSanitize] }} />

@R3D-Z3R0
Copy link

R3D-Z3R0 commented Sep 18, 2021

Hello @samuelemarro , in your workaround does it sanitize the below payload:

[a] (javascript:prompt(document.domain))

Note: remove the space after [a]

@samuelemarro
Copy link

@R3D-Z3R0 Can confirm it sanitizes. You can check it live here (select Markdown from the dropdown).

@R3D-Z3R0
Copy link

R3D-Z3R0 commented Dec 11, 2021

@R3D-Z3R0 Can confirm it sanitizes. You can check it live here (select Markdown from the dropdown).
@jaywcjlove @samuelemarro

We have faced another issue with another payload, it renders whatever image you put on that src:
"><img src="https://test.co">poc

image

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

4 participants