fix(Markdown): render markdown in more secure way
This commit changes markdown sanitization behaviour in following way: class, style and data-* attributes are removed by default. These attributes open possible vulnerability vectors to attackers. The original behavior of sanitizer (before this commit) can be enabled by *useUnsafeMarkdown* configuration option. Use this configuration option with caution and only in cases when you know what you're doing.
This commit is contained in:
@@ -102,7 +102,7 @@ export default class ParameterRow extends Component {
|
||||
.get("content", Map())
|
||||
.keySeq()
|
||||
.first()
|
||||
|
||||
|
||||
// getSampleSchema could return null
|
||||
const generatedSampleValue = schema ? getSampleSchema(schema.toJS(), parameterMediaType, {
|
||||
includeWriteOnly: true
|
||||
@@ -144,7 +144,7 @@ export default class ParameterRow extends Component {
|
||||
this.onChangeWrapper(initialValue)
|
||||
} else if(
|
||||
schema && schema.get("type") === "object"
|
||||
&& generatedSampleValue
|
||||
&& generatedSampleValue
|
||||
&& !paramWithMeta.get("examples")
|
||||
) {
|
||||
// Object parameters get special treatment.. if the user doesn't set any
|
||||
@@ -202,7 +202,7 @@ export default class ParameterRow extends Component {
|
||||
/>
|
||||
|
||||
const ModelExample = getComponent("modelExample")
|
||||
const Markdown = getComponent("Markdown")
|
||||
const Markdown = getComponent("Markdown", true)
|
||||
const ParameterExt = getComponent("ParameterExt")
|
||||
const ParameterIncludeEmpty = getComponent("ParameterIncludeEmpty")
|
||||
const ExamplesSelectValueRetainer = getComponent("ExamplesSelectValueRetainer")
|
||||
|
||||
Reference in New Issue
Block a user