Possibility of self-xss
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 2.9k
- Forks
- 201
- Avg merge
- 12m
- Merged PRs (30d)
- 1
Description
If you put an executable script inside the input when in preview mode, self xss will happen. If you save, and other user can open the same page, for example, xss will happen.
Can this is be somehow handled on the side of the library or provide some code for sanitization somehow?
XSS attack example
<iframe srcDoc=""<img src=x onerror=alert('XSS attack')>">
Thanks!
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the reported XSS using the iframe payload in the React markdown editor's preview and saved-content flow. Inspect the preview and rendering entry points to determine where executable input is accepted; done means the example no longer executes when previewed or opened by another user, with the behavior covered by a regression test.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- react, typescript
- Domain
- frontend, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100