This repository was archived by the owner on Jul 19, 2019. It is now read-only.
Stored XSS in Mark Down #139
Comments
|
:( thanks. ugh. are there any popular libraries that don't have this problem? looks like showdown doesn't try to defend against XSS. |
|
https://github.com/jonschlinkert/remarkable looked good to me, but I can look over a few alts. |
|
Do you think I should also add a ticket for the https://github.com/facebook/react gh-page branch? |
|
No thanks, I'll get both. |
sophiebits
added a commit
to sophiebits/react-tutorial
that referenced
this issue
Jun 3, 2016
sophiebits
added a commit
to sophiebits/react
that referenced
this issue
Jun 3, 2016
sophiebits
added a commit
that referenced
this issue
Jun 3, 2016
|
(React change in facebook/react#6961.) |
sophiebits
added a commit
to facebook/react
that referenced
this issue
Jun 3, 2016
sophiebits
added a commit
to facebook/react
that referenced
this issue
Jun 3, 2016
reactjs/react-tutorial#139 (cherry picked from commit 1801d56)
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Uh oh!
There was an error while loading. Please reload this page.
The markdown library (marked) used in this demo does not properly handle HTML entities (even with the sanitize option set to true). This leads to a stored XSS in this demo.
The marked project also appears to be abandoned. I suggest using something else in the demo. I know this is not intended to be production code, but people will follow this as an example. You can also see this in action on the main https://facebook.github.io/react/ page under "A Component Using External Plugins" as a "self xss"
POC:
Run the project and submit a comment with the following markdown:
References:
The pull request I opened to them (a long time ago):
markedjs/marked#592
A full writeup on the actual issue:
https://snyk.io/blog/marked-xss-vulnerability/
The Node Security Advisory:
https://nodesecurity.io/advisories/101
As well as RetireJS:
http://retirejs.github.io/retire.js/
The text was updated successfully, but these errors were encountered: