HumanSignal / HumanSignal/label-studio

Regression in non-inline HyperText/iframe HTML support caused by a fix to a hypothetical vulnerability

Open
#5,860 1 comment 0 reactions 0 assignees View on GitHub
Community community:issue community:reviewed
Dominant language
TypeScript
Stars
28.3k
Forks
3.7k
Avg merge
14h
Merged PRs (30d)
15

Description

**Describe the bug**
Annotating data within an iframe (wikipedia articles, etc) in the HyperText element is no longer possible, as tags are filtered out from HTML content starting from 1.11.0. This is a regression in 1.11.0 caused by https://github.com/HumanSignal/label-studio/pull/5232

**To Reproduce**
Use non-inline iframe in the HyperText element and include <script> tag.

**Expected behavior**
It should be possible to render modern HTML that includes scripting withing the HyperText/iframe.

**Environment (please complete the following information):**
- OS: [e.g. iOS]
- Label Studio Version 1.12.0

**Additional context**
Sanitized internal data or data from sources like wikipedia can not contain a hypothetical vulnerability highlighted by this CVE. This hypothetical vulnerability is also unimpactful, as the service is stand-alone and isolated from any high-value financial/industry targets.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.