epam / epam/Indigo

Mol file with XSS should be opened correctly as KET file.

Open
#1,965 0 comments 0 reactions 0 assignees View on GitHub
Priority: Medium
Dominant language
C++
Stars
406
Forks
134
Avg merge
2d 11h
Merged PRs (30d)
24

Description

**Steps to Reproduce**
1. Switch to Macro
2. Open file with Chem with injection (like XSS)
[ketcher (20).zip](https://github.com/epam/ketcher/files/15247866/ketcher.20.zip)

![image](https://github.com/epam/ketcher/assets/161723514/b3506730-73fc-4c32-acf8-200aeec64de1)

4. Save as Mol file
[ketcher (7).zip](https://github.com/epam/ketcher/files/15247875/ketcher.7.zip)

5. Try to open the mol file again
image

**Actual behavior**
We can save structure with XSS.
We cannot open this file again.
image

**Expected behavior**
Should be the same behavior as for КЕТ file (xss is ignored and visible as text)
Chem Structure should be visible as for KET file.

**Desktop (please complete the following information):**
- OS: Windows 11
- Browser Chrome
- Version 112.0.5615.138 (Official Build) (64-bit)

**Ketcher version**
[Version 2.21.0-rc.2](https://lifescience.opensource.epam.com/ketcher/index.html)
Build at 2024-05-07; 12:32:44

[Indigo Toolkit](http://lifescience.opensource.epam.com/indigo/)
Version 1.20.0-rc.2.0-g111a89f35-wasm32-wasm-clang-12.0.0

Contributor guide

No contributing guide indexed for this repository

Research direction

Reproduce the Mol-file open failure with the attached files after saving a structure containing the reported injection, then compare the Mol and KET import paths. Trace the file-opening entry point and existing XSS handling; done means the Mol file opens with the structure visible and the injection displayed only as text, as with KET.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
security, tooling
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.