XSS Vulnerability

Hey,

someone pointed out an issue in another Angular markdown library about XSS vulnerability and it seems that this library presents the same issue as well.

Links are not being validated and as such, the following code could be used to execute javascript code:

[Click Me](javascript:alert('Injected!'%29)

[jfcere]

⚠️ Breaking Change

Dependencies as been updated to support Marked 0.8.0 in latest ngx-markdown v9.0.0 release and brings some breaking changes regarding sanitization configuration.

Due to deprecation by Marked, the following properties has been removed from MarkedOptions when configuring the MarkdownModule:

• sanitize: boolean
• sanitizer: function

Instead, sanitization is now enabled by default when importing MarkdownModule.forRoot(). It uses Angular DomSanitizer with SecurityContext.HTML by default to avoid XSS vulnerabilities. The security level can be configured/turn-off by specifying the SecurityContext using sanitize option (outside markedOptions).

import { SecurityContext } from '@angular/core';

// enable default sanitization
MarkdownModule.forRoot()

// turn off sanitization
MarkdownModule.forRoot({
  sanitize: SecurityContext.NONE
})

Be sure to follow the sanitization section in the README file for instruction.

[jfcere]

I’ve communicated with NPM Security Team and after providing mitigation steps they removed the vulnerability report.

They are suggesting me to add a warning to the README.md documentation in order to bring this issue/workaround to user’s attention to avoid potential security risks.

A second option would be to switch the sanitize option to true by default and still add documentation on how to turn it off.

Action will be taken soon about the documentation and I’ll think about the default value of sanitize option.