Skip to content

Conversation

@bddjong
Copy link
Contributor

@bddjong bddjong commented May 16, 2024

  • Add dom purify
  • Test output is still the same
  • Test output is sanitized if needed (need to check how to test this, what's supposed to be sanitized)
  • Investigate how how to sanitize the JSON save option (we don't use it but the code path exists now.)

@bddjong bddjong requested a review from Robbert May 16, 2024 09:26
@bddjong
Copy link
Contributor Author

bddjong commented May 21, 2024

Tested that its (at least partially) working by temporarily stripping data-attributes. Potentially XSS href's arent being stripped correctly though. I suspect the output is already escaped at the point where dom-purify is implemented now, which could cause it to just ignore it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants