Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

The h-entry content value should be sanitized/escaped before outputting it in HTML #115

Open
kizu opened this issue Oct 29, 2023 · 0 comments
Open

The h-entry content value should be sanitized/escaped before outputting it in HTML #115

kizu opened this issue Oct 29, 2023 · 0 comments

Comments

@kizu
Copy link

kizu commented Oct 29, 2023

Example: https://indiewebify.me/validate-h-entry/?url=https%3A%2F%2Fpotential-xss--kizu-blog.netlify.app%2Fweekly-bookmarks-002%2F — results in an XSS, as the source had an escaped HTML inside <code> elements, but then the value gets the unescaped content (which seems to be expected).

I noticed this when testing the parsing of microformats for my blog as a part of IndieWebCamp — https://indiewebify.me/validate-h-entry/?url=https%3A%2F%2Fblog.kizu.dev%2Fweekly-bookmarks-002%2F — and noticing the broken output:

A screenshot of a broken output of the indiewebify h-entry validator, showing how the unescaped code element breaks the display
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@kizu