New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Sanitize srcdoc attribute #654

Open

vladKrk opened this issue Mar 3, 2025 · 1 comment

vladKrk commented Mar 3, 2025 •

edited

Loading

Package version

4.40.0

Node version
20.10.0

Platform
No response

Problem

In iframe srcdoc element user can inject any script that could produce XSS attack

Solution

Sanitize srcdoc attribute, remove any scripts from there

Author

vladKrk commented Mar 3, 2025

The same issue in sanitize-html

apostrophecms/sanitize-html#217

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment