Shane Kilkelly 7f7b10aa09 Sanitize display of system messages. ...

When showing system-messages, use default Angular sanitizer, also,
on the admin panel itself, show the verbatim text of the message.

This solves a mild Stored-XSS vulnerability whereby a user could
put `<script>` tags in a message. We don't want that, but we do want
to be able to use basic html tags.

2018-08-22 10:15:50 +01:00

services/web

Sanitize display of system messages.

2018-08-22 10:15:50 +01:00

S

Description

Quarto presentation editor based on the Overleaf framework

AGPL-3.0 297 MiB

Languages

JavaScript 62.6%

TypeScript 29.5%

SCSS 2.9%

Java 2.1%

Pug 0.8%

Other 1.9%