Sanitize href props with xss vulnerability #999
Closed
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Sanitize html props that are vulnerable to xss vulnerability if user data is inserted.
Here's an example:
Applied the same fix as plotly/dash#2732
The
href
prop is sanitized using the braintree/sanitize-urlContent with vulnerabilities are replaced with "about:blank", and an error message is sent.
Dash 2.15 has a new prop:
I've included this, but it only sends the error message when using Dash 2.15. Earlier Dash versions will not show an error in the console or the dev tools, but the prop is still sanitized.
Would you like to bump the
install_requires
todash>=2.15
? I'm not sure how that would affect people that need to specify a dash version to get certain flask version.Before writing the tests would you like to take a quick look? You can run
usage.py
to see all the components that are updated so far.To Do: