HumanSignal / HumanSignal/label-studio
Regression in non-inline HyperText/iframe HTML support caused by a fix to a hypothetical vulnerability
- Dominant language
- TypeScript
- Stars
- 28.3k
- Forks
- 3.7k
- Avg merge
- 14h
- Merged PRs (30d)
- 15
Description
**Describe the bug**
Annotating data within an iframe (wikipedia articles, etc) in the HyperText element is no longer possible, as tags are filtered out from HTML content starting from 1.11.0. This is a regression in 1.11.0 caused by https://github.com/HumanSignal/label-studio/pull/5232
**To Reproduce**
Use non-inline iframe in the HyperText element and include <script> tag.
**Expected behavior**
It should be possible to render modern HTML that includes scripting withing the HyperText/iframe.
**Environment (please complete the following information):**
- OS: [e.g. iOS]
- Label Studio Version 1.12.0
**Additional context**
Sanitized internal data or data from sources like wikipedia can not contain a hypothetical vulnerability highlighted by this CVE. This hypothetical vulnerability is also unimpactful, as the service is stand-alone and isolated from any high-value financial/industry targets.
Contributor guide
Assessment
This issue has not been assessed yet.