New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

#

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Jump to bottom

This library is XSS vulnerable #916

Closed

smithb1994 opened this issue Jul 22, 2017 · 1 comment

smithb1994 commented Jul 22, 2017 •

edited

Loading

Even with sanitize enabled, data uri are allowing XSS attacks:

[xss link](data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K)

A good solution, is to only allow http or https links.

The text was updated successfully, but these errors were encountered:

Contributor

matt- commented Aug 2, 2017

This has been reported a few times. The maintainer will not respond to PR's or push new versions.

and pull request #844

matt- closed this as completed

# for free to join this conversation on GitHub. Already have an account? # to comment