Unfiltered class attribute in markdown code
Open
security
- Dominant language
- JavaScript
- Stars
- 10.1k
- Forks
- 1.1k
- PR merge metrics
- No merged PRs in 30d
Description
Hello, CodiMD:
This bug affects every note in CodiMD.
It could be used to create a phishing note.
I have not reviewed the code about this, however I suggest to filter every class attributes.
Here's the PoC code:
### POC
```
```
And here's the demo phishing page: [Demo Note](https://hackmd.io/TFu9gvm6R7O2rwdEAKdlzg#)

### Suggested fix
* Filter class attributes
Ref: https://github.com/ChALkeR/notes/blob/master/Improper-markup-sanitization.md
Contributor guide
Assessment
This issue has not been assessed yet.