Security feature request: a setting to block inline javascript

[winterstein]

Firstly, thank you for this useful package 👍

We want to allow html (so escapeHtml={false}) -- but not allow onClick, onMouseOver, onX etc handlers -- as these would allow an attacker to inject javascript traps.

I don't think there is a way to do this. So I'm requesting a feature to block inline javascript.

Meanwhile, we can achieve this by pre-filtering the input with a few regexs.

[codefull]

Firstly, thank you for this useful package 👍

We want to allow html (so escapeHtml={false}) -- but not allow onClick, onMouseOver, onX etc handlers -- as these would allow an attacker to inject javascript traps.

I don't think there is a way to do this. So I'm requesting a feature to block inline javascript.

Meanwhile, we can achieve this by pre-filtering the input with a few regexs.

Hi, could you please share your approach to filter those elements.

[winterstein]

Sure - we're sniffing for onX in a tag. If we find it, we re-enable escapeHtml for safety:

// security: no onClick etc traps	
if ( ! escapeHtml) {
	let bad = source.match(/<[^>]+\bon[a-zA-Z]+=/g, ''); // match e.g. onClick within a tag
	if (bad) {
		console.warn("Dangerous content in markdown!", bad, source);
	}
	escapeHtml = true;
}

[ChristianMurphy]

This would be supported more directly through #428, which supports https://github.com/rehypejs/rehype-sanitize

[wooorm]

This should be solved by landing GH-563 today, which will soon be released in v6.0.0!