Clarification: 1.3.1 WYSIWYG
Open
Nobody has claimed this yet.
4) proposal for review
V1 (prev V5)
- Dominant language
- HTML
- Stars
- 3.6k
- Forks
- 831
- Avg merge
- 7h 55m
- Merged PRs (30d)
- 4
Description
1.3.1 Verify that all untrusted HTML input from WYSIWYG editors or similar is sanitized using a well‑known and secure HTML sanitization library or framework feature.
- Sanitization should be done on the server side, not just the client side. This important point is missing from the requirement.
- Even “secure” well-known libraries can have vulnerabilities.
- The term “well-known” is subjective. It’s better to recommend libraries with a proven security track record and active maintenance.
- The security a sanitization library provides depends heavily on how it’s configured,default settings may not be safe or suitable for every use case.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading requirement 1.3.1 in the latest 5.0 raw Markdown, then review the 26-comment discussion on this issue. Done means reaching agreement on precise wording about server-side sanitization, library maintenance and configuration, and updating the requirement accordingly.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- html
- Domain
- documentation, security
- Issue type
- Documentation
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100