feathers-giveth icon indicating copy to clipboard operation
feathers-giveth copied to clipboard

Fix/Improve sanitisation of the DAC, Campaign an Milestone description

Open vojtechsimetka opened this issue 7 years ago • 0 comments

Currently we use HTML code directly inside of the descriptions. It is sanitised on the server side which in theory should remove all malicious code. On the client side we then use dangerouslySetInnerHTML to render the sanitised description. However, there are cases where user can be redirected or file is downloaded automatically through the description.

I suggest we wither:

  1. We improve the sanitisation in feathers
  2. We move to a markdown style description with smaller attack surface.

Example of the problem: https://alpha.giveth.io/campaigns/Bub3WLo6jmlG8V6j/milestones/17DEdOQWOQlkzUia

Reported by @GriffGreen.

vojtechsimetka avatar Feb 13 '18 09:02 vojtechsimetka