URGENT: Possible vulnerability to injection attacks

Problem: inserting arbitrary JavaScript into documents is possible, and it will execute. It also seems to cause the entire rest of the page to not render. The person with edit permission to the document cannot then remove the JS, because the edit field is also blanked out.

Solution: disable <script> tags. Do not allow execution of any JavaScript entered by the users.

For an example, try creating a new blank document, entering some dummy text, and then pasting this at the bottom:

<script> document.title = "The title"; </script> Or, see this document (and its source, which is available).

Note that the title in your web browser changes.

[jimcullenaus]

I cannot see any legitimate reason to use JavaScript in a homebrewery document. Homebrewery is for building up pages that look high-quality like the D&D published books. There’s no room for dynamic content in that. All it does is increase the attack surface.

[calculuschild]

Closing because this appears to be solved.