Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Sanitize] Sanitize content in Displayer and in Playground #32

Merged
merged 2 commits into from
Apr 29, 2022
Merged

[Sanitize] Sanitize content in Displayer and in Playground #32

merged 2 commits into from
Apr 29, 2022

Conversation

ClaireDagan
Copy link
Contributor

Sanitize des données du Displayer et du Playground

@ClaireDagan ClaireDagan self-assigned this Apr 13, 2022
@vercel
Copy link

vercel bot commented Apr 13, 2022 •
edited
Loading

This pull request is being automatically deployed with Vercel (learn more).
To see the status of your deployment, click below or on the icon next to each commit.

🔍 Inspect: https://vercel.com/kisskissbankbank/underwood/C5RGCppVJ3UqZZ6uHd6yJtQU6saZ
✅ Preview: https://underwood-git-security-sanitize-content-kisskissbankbank.vercel.app

FlorentD
FlorentD suggested changes Apr 14, 2022
View reviewed changes
Copy link
Contributor

@FlorentD FlorentD left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

C'est bien ce que je craignais. Du coup les iframe ne sont pas prises en compte. Ça ne fonctionne pas en l'état. Si tu veux ajouter une vidéo pour exemple ça ne l'affiche pas dans le Displayer

@vercel
Copy link

vercel bot commented Apr 25, 2022 •
edited
Loading

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name Status Preview Updated
underwood ✅ Ready (Inspect) Visit Preview Apr 28, 2022 at 2:08PM (UTC)

FlorentD
FlorentD approved these changes Apr 28, 2022
View reviewed changes
Copy link
Contributor

@FlorentD FlorentD left a comment •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Je valide mon propre code

Ce n'ai pas vraiment possible de "purify" une iframe cure53/DOMPurify#566
Du coup j'ai mis en sécu le fait d'avoir un nombre limité de props possibles sur son iframe et j'ai sanitize l'url du src via https://github.com/braintree/sanitize-url

J'ai l'impression que ça couvre pas mal de cas

@FlorentD FlorentD merged commit 3a6aadc into main Apr 29, 2022
@FlorentD FlorentD deleted the security/sanitize-content branch April 29, 2022 14:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@FlorentD FlorentD FlorentD approved these changes

Assignees

@ClaireDagan ClaireDagan

Labels
needs review
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@ClaireDagan @FlorentD