indieweb / indieweb/indiewebify-me
The h-entry content value should be sanitized/escaped before outputting it in HTML
- Dominant language
- CSS
- Stars
- 188
- Forks
- 26
- PR merge metrics
- No merged PRs in 30d
Description
Example: https://indiewebify.me/validate-h-entry/?url=https%3A%2F%2Fpotential-xss--kizu-blog.netlify.app%2Fweekly-bookmarks-002%2F — results in an XSS, as the source had an escaped HTML inside `` elements, but then the `value` gets the unescaped content (which seems to be expected).
I noticed this when testing the parsing of microformats for my blog as a part of [IndieWebCamp](https://indieweb.org/2023/Nuremberg) — https://indiewebify.me/validate-h-entry/?url=https%3A%2F%2Fblog.kizu.dev%2Fweekly-bookmarks-002%2F — and noticing the broken output:
Contributor guide
No contributing guide indexed for this repository
Research direction
Reproduce the issue using the indiewebify.me h-entry validator URL and inspect how the h-entry content value is rendered inside code elements. Trace the value from parsing through HTML output, then verify that escaped source content no longer breaks the display or permits XSS.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- html
- Domain
- security, web-dev
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100