This repository has been archived by the owner on Dec 19, 2023. It is now read-only.
XSS fix - Remove onload handler from svg element #1
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
📊 Metadata *
tui.editor
is vulnerable toCross-Site Scripting (XSS)
.Bounty URL: https://www.huntr.dev/bounties/1-other-tui.editor/
⚙️ Description *
TOAST UI Editor provides Markdown mode and WYSIWYG mode. Depending on the type of use you want like production of Markdown or maybe to just edit the Markdown. The TOAST UI Editor can be helpful for both the usage. It offers Markdown mode and WYSIWYG mode, which can be switched any point in time.
💻 Technical Description *
Fixed
XSS
by sanitizing user inputs before updating DOM elements, in this an edge case was arisen due to anonload
event handler not properly sanitized/removed while updating the DOM elements in the editor.🐛 Proof of Concept (PoC) *
<svg> <svg><svg onload=alert(111)> <svg>
🔥 Proof of Fix (PoF) *
// index.html
![image](https://user-images.githubusercontent.com/64132745/108257707-2f1dc000-7185-11eb-8e52-8ece420eefaf.png)
// script.js
output:
![image](https://user-images.githubusercontent.com/64132745/108257926-7c9a2d00-7185-11eb-97b7-1136f752ad6e.png)
👍 User Acceptance Testing (UAT)
After the fix, functionality is unaffected.
🔗 Relates to...
418sec/huntr#1911