Blacklist data: URLs from templates #1110
Conversation
|
I added normalizer to match cases described in #1114. |
|
LGTM, pending tests |
dvoytenko
force-pushed
the
mustache-sec2
branch
from
d917415
to
4b534d4
Compare
Blacklist data: URLs from templates
| @@ -58,6 +58,9 @@ const WHITELISTED_FORMAT_TAGS = [ | |||
| const BLACKLISTED_ATTR_VALUES = [ | |||
| /*eslint no-script-url: 0*/ 'javascript:', | |||
| /*eslint no-script-url: 0*/ 'vbscript:', | |||
| /*eslint no-script-url: 0*/ 'data:', | |||
| /*eslint no-script-url: 0*/ '<script', | |||
There was a problem hiding this comment.
Is it necessary? Attribute values will be properly encoded, so there's no chance to actually insert the angle bracket into the final HTML.
There was a problem hiding this comment.
Yes, this is probably overkill. Will remove there last one.
On Dec 10, 2015 3:07 AM, "Gábor Molnár" notifications@github.com wrote:
In src/sanitizer.js
#1110 (comment):@@ -58,6 +58,9 @@ const WHITELISTED_FORMAT_TAGS = [
const BLACKLISTED_ATTR_VALUES = [
/eslint no-script-url: 0/ 'javascript:',
/eslint no-script-url: 0/ 'vbscript:',
- /eslint no-script-url: 0/ 'data:',
- /eslint no-script-url: 0/ '<script',
Is it necessary? Attribute values will be properly encoded, so there's no
chance to actually insert the angle bracket into the final HTML.—
Reply to this email directly or view it on GitHub
https://github.com/ampproject/amphtml/pull/1110/files#r47213528.You received this message because you are subscribed to the Google Groups
"amphtml-eng-github" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to amphtml-eng-github+unsubscribe@google.com.
To post to this group, send email to amphtml-eng-github@google.com.
To view this discussion on the web visit
https://groups.google.com/a/google.com/d/msgid/amphtml-eng-github/ampproject/amphtml/pull/1110/r47213528%40github.com
https://groups.google.com/a/google.com/d/msgid/amphtml-eng-github/ampproject/amphtml/pull/1110/r47213528%40github.com?utm_medium=email&utm_source=footer
.You received this message because you are subscribed to the Google Groups
"amphtml-eng" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to amphtml-eng+unsubscribe@google.com.
To post to this group, send email to amphtml-eng@google.com.
To view this discussion on the web visit
https://groups.google.com/a/google.com/d/msgid/amphtml-eng/ampproject/amphtml/pull/1110/r47213528%40github.com
https://groups.google.com/a/google.com/d/msgid/amphtml-eng/ampproject/amphtml/pull/1110/r47213528%40github.com?utm_medium=email&utm_source=footer
.
Closes #1114.