status-im/codimd
2
0
Fork 0
mirror of https://github.com/status-im/codimd.git synced 2025-02-02 21:23:38 +00:00
Code Issues Projects Releases Wiki Activity

Don't accept sandbox attribute

Browse Source 
Because sandbox is whitelist attribute, attacker will be able to create iframe that has more permission than default.

Signed-off-by: RyotaK <49341894+ry0tak@users.noreply.github.com>
This commit is contained in:
RyotaK 2019-08-21 18:50:56 +09:00 committed by R0taK
parent 85fc41c350
commit f26a73213a
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
public/js/render.js
View File

@ -20,7 +20,7 @@ whiteList['style'] = []
// allow kbd tag
whiteList['kbd'] = []
// allow ifram tag with some safe attributes
whiteList['iframe'] = ['allowfullscreen', 'name', 'referrerpolicy', 'sandbox', 'src', 'width', 'height']
whiteList['iframe'] = ['allowfullscreen', 'name', 'referrerpolicy', 'src', 'width', 'height']
// allow summary tag
whiteList['summary'] = []
// allow ruby tag