vulnerable to xss attacks

[ghost]

This markdown editor is vulnerable to xss attacks especially the preview feature.

[acrobat]

Do you have an example case?

[ghost]

@acrobat, add javascript:alert('xss') as markdown link then click preview button. click the link in the preview, its a vulnerability!! its not safe to use especially its open to hackers!!

[groothuyse]

Looks like the above 2 commits prohibit the xss if javascript:alert('xss') is entered in the popup box, however when entering it directly in the editor it still vulnerable when hitting preview.

[ghost]

ikr

[toopay]

@iJoshuaHD @groothuyse My bad. Will re-check this soon.

[arall]

Any updates in this?

[arall]

@toopay any updates?

[toopay]

@arall I havent found a bulletproof solution for this yet.

[ar-anvd]

+1 for this. Is a critical issue.

[nnachit]

Any news ?