Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

XSS from sanitized text - <script>alert('XSS');</script>

See original GitHub issue

It’s been mentioned here already (with working example), but on an already closed issue: https://github.com/summernote/summernote/issues/1627#issuecomment-227417111 So I believe it is worth opening a new issue:

This (otherwise sanitized) code:

<textarea>
    &lt;script&gt;alert('XSS');&lt;/script&gt;</p>
</textarea>

gets executed by summernote.

Issue Analytics

State:
Created 7 years ago
Reactions:7
Comments:6 (1 by maintainers)

Top GitHub Comments

1reaction

michalskopcommented, Jul 27, 2016

Prepared Inputs into Summernote should be treated as explained here: http://stackoverflow.com/questions/26103875/script-tags-being-rendered-after-purification-in-wysiwyg#26128263

So it is seems that it is a feature, but I still believe it is worth at least mentioning in the documentation.

0reactions

abisonbinoycommented, Dec 8, 2020

it shows in website like <script>alert('XSS');</script></p>

Top Results From Across the Web

XSS: Beating HTML Sanitizing Filters - PortSwigger

XSS : Beating HTML Sanitizing Filters The most prevalent manifestation of data sanitization occurs when the application HTML-encodes certain key characters .

Cross Site Scripting Prevention - OWASP Cheat Sheet Series

This cheat sheet provides guidance to prevent XSS vulnerabilities. ... This is where Output Encoding and HTML Sanitization are critical.

How to sanitize third-party content with vanilla JS to prevent ...

How to sanitize third-party content with vanilla JS to prevent cross-site scripting (XSS) attacks. Third-party content (things like data from ...

Cross-site Scripting (XSS) in sanitize | CVE-2020-4054 | Snyk

A cross-site scripting attack occurs when the attacker tricks a legitimate web-based application or site to accept a request as originating from ...

XSS on Google Search - Sanitizing HTML in The Client?

An actual XSS on google.com by Masato Kinugawa. It abuses a parsing differential between a JavaScript enabled and disabled context.