hackmdio / hackmdio/codimd

Unfiltered class attribute in markdown code

Open
#956 5 comments 0 reactions 0 assignees View on GitHub
security
Dominant language
JavaScript
Stars
10.1k
Forks
1.1k
PR merge metrics
No merged PRs in 30d

Description

Hello, CodiMD:

This bug affects every note in CodiMD.

It could be used to create a phishing note.

I have not reviewed the code about this, however I suggest to filter every class attributes.

Here's the PoC code:
### POC
```

```
And here's the demo phishing page: [Demo Note](https://hackmd.io/TFu9gvm6R7O2rwdEAKdlzg#)

![](https://images.plurk.com/3ybPtmAMqMArywzyRlmsKw.png)

### Suggested fix
* Filter class attributes

Ref: https://github.com/ChALkeR/notes/blob/master/Improper-markup-sanitization.md

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.