diaspora/diaspora — Issue #2677: "javascript:" URLs should be sanitized in Bio
Author: pixelistik
Created: 2012-01-16 20:37:41+00:00
State: open

The markdown parsing does not filter javascript links (`href="javascript:...`) from the Bio text in user profiles.

This is an XSS vulnerability. By clicking on a harmless-looking link, users could trigger all sorts of unwanted actions in their context.

Just try to put this in your profile text:
`[Click Me!](javascript:alert\('Hello'\);)`

This used to even work in posts and comments, but the new markdown library seems to sanitize it. However, you might want to add tests for this, so it doesn't come back.