Possibility of self-xss

[xxmuaddib]

If you put an executable script inside the input when in preview mode, self xss will happen. If you save, and other user can open the same page, for example, xss will happen.

Can this is be somehow handled on the side of the library or provide some code for sanitization somehow?

XSS attack example

<iframe srcDoc=""<img src=x onerror=alert('XSS attack')>">

Thanks!

[jaywcjlove]

@xxmuaddib You can refer to these issues.

• rehype pluguns doesn't affected (XSS Vulnerable) #574
• Img and P tags are not working in preview of MdEditor: #560
• Breaks the application when try to edit the code snippet extension beside #406 (comment)
• [Security] Vulnerable to XSS  #249 (comment)