feat: markdown sanitization of form tag (#7146)

2021-03-31 11:03:57 -07:00
parent 4abbc62b87
commit f5b84e59ce
2 changed files with 13 additions and 1 deletions
--- a/src/core/components/providers/markdown.jsx
+++ b/src/core/components/providers/markdown.jsx
@@ -68,7 +68,7 @@ export function sanitizer(str, { useUnsafeMarkdown = false } = {}) {

  return DomPurify.sanitize(str, {
    ADD_ATTR: ["target"],
-    FORBID_TAGS: ["style"],
+    FORBID_TAGS: ["style", "form"],
    ALLOW_DATA_ATTR,
    FORBID_ATTR,
  })