GrapesJS / GrapesJS/mjml

BUG: Component attributes data not sanitized properly leading to self XSS

Open
#391 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
716
Forks
251
PR merge metrics
No merged PRs in 30d

Description

### GrapesJS version

- [x] I confirm to use the latest version of GrapesJS

### GrapesJS MJML version

- [x] I confirm to use the latest version of GrapesJS MJML

### What browser are you using?

Chrome 126

### Reproducible demo link

https://grapesjs.com/demo-mjml.html

### Describe the bug

**How to reproduce the bug?**
1. Go to https://grapesjs.com/demo-mjml.html
2. Select any component
3. Set component's `id` attribute's value to `123">123`

**What is the expected behavior?**
... The XSS code in the attribute's value should be sanitized and removed.

**What is the current behavior?**
... The XSS code executes and triggers an alert(as seen in [this video](https://www.awesomescreenshot.com/video/36344718?key=612a5a9d7644eb6c4d2f835a86a197d3)). This happens only with GrapesJS MJML node module. With core GrapesJS editor the issue doesn't occur as seen [here](https://i.ibb.co/4ZwYsKDY/Peek-2025-02-07-14-34.gif) on core editor demo site.

### Code of Conduct

- [x] I agree to follow this project's Code of Conduct

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.