fix(Markdown): render markdown in more secure way

This commit changes markdown sanitization behaviour in following way:

class, style and data-* attributes are removed by default. These attributes
open possible vulnerability vectors to attackers.

The original behavior of sanitizer (before this commit) can be enabled by *useUnsafeMarkdown* configuration option.
Use this configuration option with caution and only in cases when you know
what you're doing.
This commit is contained in:
Vladimir Gorej
2020-06-11 14:54:40 +02:00
parent 48a0b46942
commit a616cb471d
22 changed files with 83 additions and 33 deletions

View File

@@ -71,6 +71,10 @@ const standardVariables = {
type: "boolean",
name: "showCommonExtensions"
},
USE_UNSAFE_MARKDOWN: {
type: "boolean",
name: "useUnsafeMarkdown"
},
OAUTH2_REDIRECT_URL: {
type: "string",
name: "oauth2RedirectUrl"