Make Markdown safe #21

New Issue

2020-06-14T18:53:45Z

phryk commented

2020-06-14 18:53:45 +00:00

(Migrated from rnd.phryk.net)

Currently any md.MarkdownField is an open invitation for XSS.
This should be fixed, even though none of those are exposed to
users who aren't logged in and have permission to add/edit
Storables with MarkdownFields.

Far as we know, md.MarkdownString is the only way markdown is currently used.
This means this is a central place where we can do cleanup of the input string.
markupsafe.Markup offers some nice functions like escape and strip_tags
for this. We might want to have a whitelist of allowed tags.

Currently any `md.MarkdownField` is an open invitation for XSS. This should be fixed, even though none of those are exposed to users who aren't logged in and have permission to add/edit `Storable`s with `MarkdownField`s. Far as we know, `md.MarkdownString` is the only way markdown is currently used. This means this is a central place where we can do cleanup of the input string. `markupsafe.Markup` offers some nice functions like `escape` and `strip_tags` for this. We might want to have a whitelist of allowed tags.

Sign in to join this conversation.