Avoid XSS from data-verify / data-caution attributes #335
Conversation
Codecov Report
@@ Coverage Diff @@
## master #335 +/- ##
============================================
- Coverage 26.18% 26.17% -0.01%
Complexity 5740 5740
============================================
Files 80 80
Lines 15747 15747
============================================
- Hits 4123 4122 -1
- Misses 11624 11625 +1
Continue to review full report at Codecov.
|
|
This looks great! Thanks so much for solving these! I think we're still missing part of the external image issue. If someone adds the html in an entry, and then the entry is viewed in the admin area or using a view, loading the image would be vulnerable. Did you see my note about this in the issue? |
There was a problem hiding this comment.
This looks good. We just need to double check the upgrade messages that include HTML. Some include images in the upgrade message. @jairoprez can you test this in the lite version?
There was a problem hiding this comment.
@stephywells @Crabcyborg I did some testing and it seems that we are well covered for now:
Fixes a vulnerability Steph mentions in https://github.com/Strategy11/formidable-pro/issues/2827#issuecomment-762478526
This can be exploited when someone creates an anchor tag that matches our expected attribute.
Also fixes https://github.com/Strategy11/formidable-pro/issues/2846