Impact
Affected versions of the link plugin and link UI component do not sanitize URLs to prevent use of the javascript: scheme. As a result, links with JavaScript URLs can be inserted into the Plate editor through various means, including opening or pasting malicious content.
Patches
@udecode/plate-link 20.0.0 resolves this issue by introducing an allowedSchemes option to the link plugin, defaulting to ['http', 'https', 'mailto', 'tel']. URLs using a scheme that isn't in this list will not be rendered to the DOM.
Workarounds
If you are unable to update @udecode/plate-link to version 20.0.0, we recommend overriding the LinkElement and PlateFloatingLink components with implementations that explicitly check the URL scheme before rendering any anchor elements.
OliverWales Reporter
Impact
Affected versions of the link plugin and link UI component do not sanitize URLs to prevent use of the
javascript:scheme. As a result, links with JavaScript URLs can be inserted into the Plate editor through various means, including opening or pasting malicious content.Patches
@udecode/plate-link20.0.0 resolves this issue by introducing anallowedSchemesoption to the link plugin, defaulting to['http', 'https', 'mailto', 'tel']. URLs using a scheme that isn't in this list will not be rendered to the DOM.Workarounds
If you are unable to update
@udecode/plate-linkto version 20.0.0, we recommend overriding theLinkElementandPlateFloatingLinkcomponents with implementations that explicitly check the URL scheme before rendering any anchor elements.