Mol file with XSS should be opened correctly as KET file.
- Dominant language
- C++
- Stars
- 406
- Forks
- 134
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 24
Description
**Steps to Reproduce**
1. Switch to Macro
2. Open file with Chem with injection (like XSS)
[ketcher (20).zip](https://github.com/epam/ketcher/files/15247866/ketcher.20.zip)

4. Save as Mol file
[ketcher (7).zip](https://github.com/epam/ketcher/files/15247875/ketcher.7.zip)
5. Try to open the mol file again
**Actual behavior**
We can save structure with XSS.
We cannot open this file again.
**Expected behavior**
Should be the same behavior as for КЕТ file (xss is ignored and visible as text)
Chem Structure should be visible as for KET file.
**Desktop (please complete the following information):**
- OS: Windows 11
- Browser Chrome
- Version 112.0.5615.138 (Official Build) (64-bit)
**Ketcher version**
[Version 2.21.0-rc.2](https://lifescience.opensource.epam.com/ketcher/index.html)
Build at 2024-05-07; 12:32:44
[Indigo Toolkit](http://lifescience.opensource.epam.com/indigo/)
Version 1.20.0-rc.2.0-g111a89f35-wasm32-wasm-clang-12.0.0
Contributor guide
No contributing guide indexed for this repository
Research direction
Reproduce the Mol-file open failure with the attached files after saving a structure containing the reported injection, then compare the Mol and KET import paths. Trace the file-opening entry point and existing XSS handling; done means the Mol file opens with the structure visible and the injection displayed only as text, as with KET.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- security, tooling
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100