[Security] Vulnerable to XSS attacks.

[OmkarK45]

Issue : The textarea doesn't do any validation or sanitize any input to it.

What is happening : This makes editor execute inline html code.

How to reproduce ? : Simply type <img src onerror="alert('hey!')"/> in input box

[OmkarK45]

Screenshot

[jaywcjlove]

@OmkarK45 You can try to setting previewOptions?: ReactMarkdownProps;

<MDEditor
  value="Hello Markdown!"
  previewOptions={{
  
  }}
/>

• transformLinkUri - function|null Function that gets called for each encountered link with a single argument - uri. The returned value is used in place of the original. The default link URI transformer acts as an XSS-filter, neutralizing things like javascript:, vbscript: and file: protocols. If you specify a custom function, this default filter won't be called, but you can access it as require('react-markdown').uriTransformer. If you want to disable the default transformer, pass null to this option.
• escapeHtml - boolean Setting to false will cause HTML to be rendered (see notes below about proper HTML support). Be aware that setting this to false might cause security issues if the input is user-generated. Use at your own risk. (default: true).
• skipHtml - boolean Setting to true will skip inlined and blocks of HTML (default: false).

[OmkarK45]

Thank you for replying. I will try this ✌️

[OmkarK45]

Update : Your answer fixed the issue. Thanks again. I'm closing the issue now.

[OmkarK45]

[image: image.png] <MDEditor height={400} value={value} onChange={setValue} previewOptions={{ transformLinkUri: null, skipHtml: true, }} />

…

On Fri, Oct 30, 2020 at 2:29 AM Antwan Sherif ***@***.***> wrote: @OmkarK45 <https://github.com/OmkarK45> Can you share with me a code snippet of the settings you used? Because adding "" to the editor still produces the alert! — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#56 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AK3SOWXIUUQAOYCYTRQGMK3SNHJSBANCNFSM4TCAYWRQ> .

[jaywcjlove]

• [Security] Vulnerable to XSS  #249