nozer/quill-delta-to-html

Sanitize link attribute

laukaichung opened this issue · 2 comments

laukaichung commented

I've found that people can inject xss in the link attribute:

{"ops":[{"attributes":{"link":"javascript:alert(8007)"},"insert":"link"}]}

The browser will execute the javascript when you click the link.

Would you consider removing this sort of injection in the link attribute by escaping these characters?

export function escapeLink(string) {
    return string
        .replace(/&/g, "&")
        .replace(/</g, "&lt;")
        .replace(/>/g, "&gt;")
        .replace(/\(/g, "&#40;")
        .replace(/\)/g, "&#41;")
        .replace(/"/g, "&quot;");
};
nozer commented

Will do. thank you for reporting that

  • 👍1
nozer commented

Fixed and pushed to tag v0.7.0