feathers-giveth
feathers-giveth copied to clipboard
Fix/Improve sanitisation of the DAC, Campaign an Milestone description
Currently we use HTML code directly inside of the descriptions. It is sanitised on the server side which in theory should remove all malicious code. On the client side we then use dangerouslySetInnerHTML
to render the sanitised description. However, there are cases where user can be redirected or file is downloaded automatically through the description.
I suggest we wither:
- We improve the sanitisation in feathers
- We move to a markdown style description with smaller attack surface.
Example of the problem: https://alpha.giveth.io/campaigns/Bub3WLo6jmlG8V6j/milestones/17DEdOQWOQlkzUia
Reported by @GriffGreen.