Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

XSS Vulnerability in clipboard paste / convert #2224

Closed
RyanV opened this issue Aug 6, 2018 · 1 comment
Closed

XSS Vulnerability in clipboard paste / convert #2224

RyanV opened this issue Aug 6, 2018 · 1 comment

Comments

@RyanV
Copy link
Contributor

RyanV commented Aug 6, 2018 •
edited
Loading

Steps for Reproduction

  1. Visit this codepen
  2. copy "Copy Me"
  3. Paste into editor

Expected behavior:
No scripts should run

Actual behavior:
Script runs on paste

Platforms:
MacOS Sierra 10.12.6
Chrome 68.0.3440.84
Firefox Quantum 61.0.1
Safari 11.1.1 (Problem not present)

Version:
2.0.0-dev.2

While this may not be a likely scenario if all sources are trusted, this isn't always the case.

These lines are the problem:
https://github.com/quilljs/quill/blob/ae22be5ac37a4ca62e22ff4866b4c455c2ec9d23/modules/clipboard.js#L87-L88

The fix:
use DomParser or document.implementation.createHTMLDocument
@RyanV RyanV mentioned this issue Aug 7, 2018
Merged
@jhchen
Copy link
Member

jhchen commented Aug 9, 2018

Fixed in #2226

@jhchen jhchen closed this as completed Aug 9, 2018
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@jhchen @RyanV