Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

escaped HTML entities like > were unescaped in the final mjml output #54

Merged
merged 1 commit into from Feb 22, 2024

Conversation

FelixSchwarz
Copy link
Owner

Fixes #52

@sh-at-cs, @caseyjhol: In the end I went for a really narrow unescaping implementation. By doing so I hope that there are fewer potential security issues (who knows what obscure features CSS has/will get?). Do you think that this minimal implementation is good as well?

@caseyjhol
Copy link
Contributor

Nice! I think this is a good solution. Thanks for the quick turnaround, and apologies for overlooking this in the first place.

@caseyjhol
Copy link
Contributor

Do we want to consider releasing this as a patch instead of a minor release?

@FelixSchwarz
Copy link
Owner Author

apologies for overlooking this in the first place.

No worries, I did the same mistake back then.

Do we want to consider releasing this as a patch instead of a minor release?

I think this is a pretty security major issue given the possibility that untrusted users might heavily rewrite the structure of emails sent through a web platform. Therefore I'd prefer putting this out as a "minor" release.

@FelixSchwarz FelixSchwarz merged commit 8d410b7 into main Feb 22, 2024
9 checks passed
@FelixSchwarz FelixSchwarz deleted the fix-unescaped-html-tags branch February 22, 2024 17:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Escaped HTML tags are "un-escaped" when rendering HTML
2 participants