Filter <meta> tags from notes

[orthecreedence]

Notes allow <meta> tag injection. Ie, a note with the content

<META HTTP-EQUIV="refresh" CONTENT="0; URL=https://google.com">

opens a new browser window to Google. While this problem would happen over person-to-person sharing and thus the severity is limited (because you generally only share with those you trust) it remains high priority.

Special thanks to Rafay Baloch and Muhammad Samak for this report.

[dbmohit]

can i work on this?

[orthecreedence]

Yeah, please do! This would be a good kick in the pants for me to do a security release. If you need any help getting the app set up, let me know.