fix(Markdown): render markdown in more secure way
This commit changes markdown sanitization behaviour in following way: class, style and data-* attributes are removed by default. These attributes open possible vulnerability vectors to attackers. The original behavior of sanitizer (before this commit) can be enabled by *useUnsafeMarkdown* configuration option. Use this configuration option with caution and only in cases when you know what you're doing.
This commit is contained in:
@@ -34,7 +34,7 @@ export default class Primitive extends Component {
|
||||
let properties = schema
|
||||
.filter( ( v, key) => ["enum", "type", "format", "description", "$$ref"].indexOf(key) === -1 )
|
||||
.filterNot( (v, key) => extensions.has(key) )
|
||||
const Markdown = getComponent("Markdown")
|
||||
const Markdown = getComponent("Markdown", true)
|
||||
const EnumModel = getComponent("EnumModel")
|
||||
const Property = getComponent("Property")
|
||||
|
||||
|
||||
Reference in New Issue
Block a user