Skip to content

Commit

Permalink
Electron: Resolves #500: Fixed XSS security vulnerability
Browse files Browse the repository at this point in the history
  • Loading branch information
@laurent22
laurent22 committed May 9, 2018
1 parent 85219a6 commit 494e235
Show file tree
Hide file tree
Showing 3 changed files with 17 additions and 8 deletions.
4 changes: 4 additions & 0 deletions README.md
View file
Expand Up @@ -253,6 +253,10 @@ Checkboxes can be added like so:

The checkboxes can then be ticked in the mobile and desktop applications.

## HTML support

Only the `<br>` tag is supported - it can be used to force a new line, which is convenient to insert new lines inside table cells. For security reasons, other HTML tags are not supported.

# Donations

Donations to Joplin support the development of the project. Developing quality applications mostly takes time, but there are also some expenses, such as digital certificates to sign the applications, app store fees, hosting, etc. Most of all, your donation will make it possible to keep up the current development standard.
Expand Down
5 changes: 4 additions & 1 deletion ReactNativeClient/lib/MdToHtml.js
View file
Expand Up @@ -389,7 +389,7 @@ class MdToHtml {
const md = new MarkdownIt({
breaks: true,
linkify: true,
html: true,
html: false, // For security, HTML tags are not supported - https://github.com/laurent22/joplin/issues/500
});

// This is currently used only so that the $expression$ and $$\nexpression\n$$ blocks are translated
Expand Down Expand Up @@ -435,6 +435,9 @@ class MdToHtml {
}
}

// Support <br> tag to allow newlines inside table cells
renderedBody = renderedBody.replace(/&lt;br&gt;/gi, '<br>');

// https://necolas.github.io/normalize.css/
const normalizeCss = `
html{line-height:1.15;-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}body{margin:0}
Expand Down
16 changes: 9 additions & 7 deletions docs/index.html
View file
Expand Up @@ -454,6 +454,8 @@ <h2 id="checkboxes">Checkboxes</h2>
- [ ] Rice
- [ ] Eggs
</code></pre><p>The checkboxes can then be ticked in the mobile and desktop applications.</p>
<h2 id="html-support">HTML support</h2>
<p>Only the <code>&lt;br&gt;</code> tag is supported - it can be used to force a new line, which is convenient to insert new lines inside table cells. For security reasons, other HTML tags are not supported.</p>
<h1 id="donations">Donations</h1>
<p>Donations to Joplin support the development of the project. Developing quality applications mostly takes time, but there are also some expenses, such as digital certificates to sign the applications, app store fees, hosting, etc. Most of all, your donation will make it possible to keep up the current development standard.</p>
<p>Please see the <a href="https://joplin.cozic.net/donate/">donation page</a> for information on how to support the development of Joplin.</p>
Expand Down Expand Up @@ -499,14 +501,14 @@ <h1 id="localisation">Localisation</h1>
<td><img src="https://joplin.cozic.net/images/flags/country-4x3/hr.png" alt=""></td>
<td>Croatian</td>
<td><a href="https://github.com/laurent22/joplin/blob/master/CliClient/locales/hr_HR.po">hr_HR</a></td>
<td>Hrvoje Mandić <a href="&#109;&#x61;&#x69;&#x6c;&#x74;&#x6f;&#x3a;&#116;&#x72;&#98;&#117;&#104;&#x6f;&#109;&#64;&#110;&#x65;&#116;&#x2e;&#104;&#114;">&#116;&#x72;&#98;&#117;&#104;&#x6f;&#109;&#64;&#110;&#x65;&#116;&#x2e;&#104;&#114;</a></td>
<td>Hrvoje Mandić <a href="&#109;&#x61;&#105;&#x6c;&#116;&#x6f;&#x3a;&#116;&#x72;&#x62;&#x75;&#x68;&#111;&#x6d;&#x40;&#x6e;&#x65;&#116;&#46;&#x68;&#x72;">&#116;&#x72;&#x62;&#x75;&#x68;&#111;&#x6d;&#x40;&#x6e;&#x65;&#116;&#46;&#x68;&#x72;</a></td>
<td>61%</td>
</tr>
<tr>
<td><img src="https://joplin.cozic.net/images/flags/country-4x3/cz.png" alt=""></td>
<td>Czech</td>
<td><a href="https://github.com/laurent22/joplin/blob/master/CliClient/locales/cs_CZ.po">cs_CZ</a></td>
<td>Lukas Helebrandt <a href="&#109;&#x61;&#x69;&#x6c;&#x74;&#x6f;&#x3a;&#108;&#x75;&#x6b;&#97;&#x73;&#x40;&#x61;&#x69;&#121;&#97;&#46;&#x63;&#x7a;">&#108;&#x75;&#x6b;&#97;&#x73;&#x40;&#x61;&#x69;&#121;&#97;&#46;&#x63;&#x7a;</a></td>
<td>Lukas Helebrandt <a href="&#x6d;&#x61;&#105;&#108;&#116;&#x6f;&#x3a;&#108;&#117;&#x6b;&#x61;&#115;&#64;&#97;&#x69;&#121;&#97;&#46;&#99;&#122;">&#108;&#117;&#x6b;&#x61;&#115;&#64;&#97;&#x69;&#121;&#97;&#46;&#99;&#122;</a></td>
<td>95%</td>
</tr>
<tr>
Expand All @@ -520,7 +522,7 @@ <h1 id="localisation">Localisation</h1>
<td><img src="https://joplin.cozic.net/images/flags/country-4x3/de.png" alt=""></td>
<td>Deutsch</td>
<td><a href="https://github.com/laurent22/joplin/blob/master/CliClient/locales/de_DE.po">de_DE</a></td>
<td>Philipp Zumstein <a href="&#x6d;&#97;&#x69;&#108;&#x74;&#x6f;&#x3a;&#122;&#x75;&#x70;&#104;&#105;&#108;&#105;&#x70;&#64;&#103;&#109;&#97;&#x69;&#x6c;&#46;&#x63;&#111;&#x6d;">&#122;&#x75;&#x70;&#104;&#105;&#108;&#105;&#x70;&#64;&#103;&#109;&#97;&#x69;&#x6c;&#46;&#x63;&#111;&#x6d;</a></td>
<td>Philipp Zumstein <a href="&#x6d;&#x61;&#105;&#108;&#x74;&#x6f;&#58;&#122;&#117;&#x70;&#104;&#x69;&#108;&#x69;&#x70;&#64;&#x67;&#109;&#x61;&#x69;&#x6c;&#x2e;&#x63;&#x6f;&#x6d;">&#122;&#117;&#x70;&#104;&#x69;&#108;&#x69;&#x70;&#64;&#x67;&#109;&#x61;&#x69;&#x6c;&#x2e;&#x63;&#x6f;&#x6d;</a></td>
<td>98%</td>
</tr>
<tr>
Expand All @@ -534,7 +536,7 @@ <h1 id="localisation">Localisation</h1>
<td><img src="https://joplin.cozic.net/images/flags/country-4x3/es.png" alt=""></td>
<td>Español</td>
<td><a href="https://github.com/laurent22/joplin/blob/master/CliClient/locales/es_ES.po">es_ES</a></td>
<td>Fernando Martín <a href="&#x6d;&#x61;&#x69;&#x6c;&#x74;&#x6f;&#x3a;&#102;&#64;&#x6d;&#114;&#116;&#x6e;&#x2e;&#101;&#115;">&#102;&#64;&#x6d;&#114;&#116;&#x6e;&#x2e;&#101;&#115;</a></td>
<td>Fernando Martín <a href="&#x6d;&#97;&#105;&#x6c;&#116;&#111;&#58;&#102;&#64;&#109;&#x72;&#116;&#110;&#46;&#x65;&#x73;">&#102;&#64;&#109;&#x72;&#116;&#110;&#46;&#x65;&#x73;</a></td>
<td>99%</td>
</tr>
<tr>
Expand All @@ -548,7 +550,7 @@ <h1 id="localisation">Localisation</h1>
<td><img src="https://joplin.cozic.net/images/flags/country-4x3/es.png" alt=""></td>
<td>Galician</td>
<td><a href="https://github.com/laurent22/joplin/blob/master/CliClient/locales/gl_ES.po">gl_ES</a></td>
<td>Marcos Lans <a href="&#x6d;&#97;&#x69;&#108;&#116;&#111;&#58;&#x6d;&#97;&#114;&#99;&#111;&#x73;&#108;&#x61;&#110;&#x73;&#103;&#97;&#x72;&#122;&#97;&#64;&#x67;&#x6d;&#x61;&#x69;&#108;&#46;&#x63;&#111;&#109;">&#x6d;&#97;&#114;&#99;&#111;&#x73;&#108;&#x61;&#110;&#x73;&#103;&#97;&#x72;&#122;&#97;&#64;&#x67;&#x6d;&#x61;&#x69;&#108;&#46;&#x63;&#111;&#109;</a></td>
<td>Marcos Lans <a href="&#x6d;&#x61;&#x69;&#x6c;&#116;&#111;&#x3a;&#109;&#x61;&#114;&#x63;&#x6f;&#115;&#x6c;&#97;&#110;&#115;&#103;&#97;&#x72;&#122;&#x61;&#x40;&#103;&#109;&#97;&#105;&#x6c;&#46;&#x63;&#x6f;&#x6d;">&#109;&#x61;&#114;&#x63;&#x6f;&#115;&#x6c;&#97;&#110;&#115;&#103;&#97;&#x72;&#122;&#x61;&#x40;&#103;&#109;&#97;&#105;&#x6c;&#46;&#x63;&#x6f;&#x6d;</a></td>
<td>95%</td>
</tr>
<tr>
Expand All @@ -569,14 +571,14 @@ <h1 id="localisation">Localisation</h1>
<td><img src="https://joplin.cozic.net/images/flags/country-4x3/br.png" alt=""></td>
<td>Português (Brasil)</td>
<td><a href="https://github.com/laurent22/joplin/blob/master/CliClient/locales/pt_BR.po">pt_BR</a></td>
<td>Renato Nunes Bastos <a href="&#x6d;&#x61;&#105;&#108;&#116;&#111;&#58;&#x72;&#x6e;&#x62;&#97;&#x73;&#116;&#x6f;&#x73;&#x40;&#x67;&#109;&#97;&#x69;&#108;&#46;&#x63;&#x6f;&#109;">&#x72;&#x6e;&#x62;&#97;&#x73;&#116;&#x6f;&#x73;&#x40;&#x67;&#109;&#97;&#x69;&#108;&#46;&#x63;&#x6f;&#109;</a></td>
<td>Renato Nunes Bastos <a href="&#x6d;&#97;&#105;&#108;&#x74;&#111;&#x3a;&#x72;&#110;&#x62;&#x61;&#115;&#x74;&#111;&#x73;&#x40;&#x67;&#109;&#x61;&#105;&#108;&#46;&#99;&#111;&#109;">&#x72;&#110;&#x62;&#x61;&#115;&#x74;&#111;&#x73;&#x40;&#x67;&#109;&#x61;&#105;&#108;&#46;&#99;&#111;&#109;</a></td>
<td>97%</td>
</tr>
<tr>
<td><img src="https://joplin.cozic.net/images/flags/country-4x3/ru.png" alt=""></td>
<td>Русский</td>
<td><a href="https://github.com/laurent22/joplin/blob/master/CliClient/locales/ru_RU.po">ru_RU</a></td>
<td>Artyom Karlov <a href="&#x6d;&#x61;&#x69;&#x6c;&#x74;&#111;&#x3a;&#97;&#114;&#116;&#x79;&#x6f;&#x6d;&#x2e;&#x6b;&#97;&#x72;&#x6c;&#x6f;&#x76;&#64;&#x67;&#x6d;&#97;&#105;&#x6c;&#x2e;&#x63;&#111;&#109;">&#97;&#114;&#116;&#x79;&#x6f;&#x6d;&#x2e;&#x6b;&#97;&#x72;&#x6c;&#x6f;&#x76;&#64;&#x67;&#x6d;&#97;&#105;&#x6c;&#x2e;&#x63;&#111;&#109;</a></td>
<td>Artyom Karlov <a href="&#x6d;&#97;&#x69;&#108;&#x74;&#x6f;&#x3a;&#97;&#x72;&#116;&#121;&#111;&#109;&#x2e;&#107;&#97;&#114;&#x6c;&#x6f;&#x76;&#x40;&#x67;&#109;&#97;&#x69;&#108;&#x2e;&#x63;&#x6f;&#109;">&#97;&#x72;&#116;&#121;&#111;&#109;&#x2e;&#107;&#97;&#114;&#x6c;&#x6f;&#x76;&#x40;&#x67;&#109;&#97;&#x69;&#108;&#x2e;&#x63;&#x6f;&#109;</a></td>
<td>94%</td>
</tr>
<tr>
Expand Down

3 comments on commit 494e235

@tessus
Copy link
Collaborator

@tessus tessus commented on 494e235 May 9, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This should be an option in settings.

I mean all applications might suffer from XSS when HTML parsing is allowed. How does MediaWiki solve this? How do other apps?

Disabling HTML is a very brutal solution and people who were actually using HTML will not be happy that their notes are broken now.

Just my 2 cents.

@laurent22
Copy link
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You could say it's a brutal solution... if it was previously supported :-) But actually I was lazy and HTML was enabled only so that the <br> tag can be used, as it's needed to insert new lines in table cells and when importing ENEX files (That tag is still supported). Otherwise HTML parsing was never officially supported nor mentioned in the docs so I hope nobody was relying on it too much.

Later on, other tags might be supported such as <img> but any HTML support will be tag by tag, and not as until now by letting the Chrome runtime execute anything passed to it.

@tessus
Copy link
Collaborator

@tessus tessus commented on 494e235 May 9, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

if it was previously supported

Ah, I see. Very good point. ;-) You really gave me a hearty laugh here.

I thought that markdown always allows html tags and that this requirement was in the specs. Never mind then.

Thanks for the info.

Please sign in to comment.