self-hosted/joplin
1
0
Fork 0
mirror of https://github.com/laurent22/joplin.git synced 2024-12-18 09:35:20 +02:00
Code Issues Releases Activity
36bf24e914
joplin/packages/app-cli/tests/md_to_html/sanitize_15.md

1 line
193 B
Markdown
Raw Normal View History

Desktop, Mobile: Security: Disable SVG tag support in editor to prevent XSS
2023-05-17 17:00:24 +02:00
<svg><use href="data:image/svg+xml,&lt;svg id='x' xmlns='http://www.w3.org/2000/svg'&gt;&lt;image href='asdf' onerror='top.require(`child_process`).execSync(`calc.exe`)' /&gt;&lt;/svg&gt;#x" />
Reference in New Issue Copy Permalink