fix(Markdown): render markdown in more secure way
This commit changes markdown sanitization behaviour in following way: class, style and data-* attributes are removed by default. These attributes open possible vulnerability vectors to attackers. The original behavior of sanitizer (before this commit) can be enabled by *useUnsafeMarkdown* configuration option. Use this configuration option with caution and only in cases when you know what you're doing.
This commit is contained in:
@@ -71,6 +71,10 @@ const standardVariables = {
|
||||
type: "boolean",
|
||||
name: "showCommonExtensions"
|
||||
},
|
||||
USE_UNSAFE_MARKDOWN: {
|
||||
type: "boolean",
|
||||
name: "useUnsafeMarkdown"
|
||||
},
|
||||
OAUTH2_REDIRECT_URL: {
|
||||
type: "string",
|
||||
name: "oauth2RedirectUrl"
|
||||
|
||||
Reference in New Issue
Block a user