Desktop, Mobile: Filter out form elements from note body to prevent p…

…otential XSS (thanks to Dmytro Vdovychinskiy for the PoC)
laurent22 · Jun 11, 2021 · feaecf7 · chinskiy · Aug 3, 2021 · feaecf7
1 parent af9f3ee
commit feaecf7
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/packages/renderer/htmlUtils.ts b/packages/renderer/htmlUtils.ts
@@ -158,7 +158,7 @@ class HtmlUtils {
 		// "link" can be used to escape the parser and inject JavaScript.
 		// Adding "meta" too for the same reason as it shouldn't be used in
 		// notes anyway.
-		const disallowedTags = ['script', 'iframe', 'frameset', 'frame', 'object', 'base', 'embed', 'link', 'meta', 'noscript'];
+		const disallowedTags = ['script', 'iframe', 'frameset', 'frame', 'object', 'base', 'embed', 'link', 'meta', 'noscript', 'button', 'form', 'input', 'select', 'textarea', 'option', 'optgroup'];
 
 		const parser = new htmlparser2.Parser({