isso-comments / isso-comments/isso
[config] "allowed-elements", "allowed-markup" should replace, not amend default allowlists
Open
Nobody has claimed this yet.
needs-decision
question
support
- Dominant language
- Python
- Stars
- 5.3k
- Forks
- 463
- Avg merge
- 3d 12h
- Merged PRs (30d)
- 3
Description
I found an issue about the markup config, any suggestions would be appreciate.
Step1, add below code to isso server config,
options = strikethrough, superscript, autolink
allowed-elements = img, blockquote, br, code, del, em, h1, h2, h3, h4, h5, h6, hr, ins, ul, li, ol, p, pre, strong, table, tbody, td, th, thead
allowed-attributes = src
Step2, In the website where you refer isso as comment fn, add below comment:
<a href=http://evil.com>clickmetochangethispassword</a>
Result: the comment was successfully rendered.
Expect: transform the a markup.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No files or tests are named. Reproduce the issue with the shown [markup] configuration and comment, then trace the allowlist handling; done means allowed-elements replaces the default list so the markup is transformed or rejected rather than rendered.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100