Vulnerability: HedgeDoc is open source software which lets you create real-time collaborative markdown notes. In HedgeDoc before version 1.7.2, an attacker can inject arbitrary JavaScript into a HedgeDoc note, which is executed when the note is viewed in slide mode. Depending on the configuration of the instance, the attacker may not need authentication to create or edit notes. The problem is patched in HedgeDoc 1.7.2. As a workaround, disallow loading JavaScript from 3rd party sites using the `Content-Security-Policy` header. Note that this will break some embedded content.
Vulnerability ID: CVE-2021-21259
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/hedgedoc/hedgedoc
Published: 2021-01-22
File: public/js/slide.js
Commit message: added sanitation to the slideMode in frontmatter

This should prevent the issue mentioned in https://github.com/hackmdio/codimd/issues/1648

Specifically left out are
- dependency (user can't really include anything anyway, because CSP forbids most domains)
- autoSlideMethod (nothing our users should be able to change as they won't write JS to be affected by this)
- keyboard (this let's users write arbitrary code and seems therefore to problematic)

See:
https://github.com/hakimel/reveal.js/blob/3.9.2/README.md#configuration
Signed-off-by: Philip Molares <philip.molares@udo.edu>
Commit author: Philip Molares

Vulnerable version (before fix):
 const defaultOptions = {  // options from yaml meta const meta = JSON.parse($('#meta').text()) var options = meta.slideOptions || {}  const view = $('.reveal') 

Fixed version (after fix):
 const defaultOptions = {  // options from yaml meta const meta = JSON.parse($('#meta').text()) var options = {   autoPlayMedia: meta.slideOptions.autoPlayMedia,   autoSlide: meta.slideOptions.autoSlide,   autoSlideStoppable: meta.slideOptions.autoSlideStoppable,   backgroundTransition: meta.slideOptions.backgroundTransition,   center: meta.slideOptions.center,   controls: meta.slideOptions.controls,   controlsBackArrows: meta.slideOptions.controlsBackArrows,   controlsLayout: meta.slideOptions.controlsLayout,   controlsTutorial: meta.slideOptions.controlsTutorial,   defaultTiming: meta.slideOptions.defaultTiming,   display: meta.slideOptions.display,   embedded: meta.slideOptions.embedded,   fragmentInURL: meta.slideOptions.fragmentInURL,   fragments: meta.slideOptions.fragments,   hash: meta.slideOptions.hash,   height: meta.slideOptions.height,   help: meta.slideOptions.help,   hideAddressBar: meta.slideOptions.hideAddressBar,   hideCursorTime: meta.slideOptions.hideCursorTime,   hideInactiveCursor: meta.slideOptions.hideInactiveCursor,   history: meta.slideOptions.history,   keyboard: meta.slideOptions.keyboard,   loop: meta.slideOptions.loop,   margin: meta.slideOptions.margin,   maxScale: meta.slideOptions.maxScale,   minScale: meta.slideOptions.minScale,   minimumTimePerSlide: meta.slideOptions.minimumTimePerSlide,   mobileViewDistance: meta.slideOptions.mobileViewDistance,   mouseWheel: meta.slideOptions.mouseWheel,   navigationMode: meta.slideOptions.navigationMode,   overview: meta.slideOptions.overview,   parallaxBackgroundHorizontal: meta.slideOptions.parallaxBackgroundHorizontal,   parallaxBackgroundImage: meta.slideOptions.parallaxBackgroundImage,   parallaxBackgroundSize: meta.slideOptions.parallaxBackgroundSize,   parallaxBackgroundVertical: meta.slideOptions.parallaxBackgroundVertical,   preloadIframes: meta.slideOptions.preloadIframes,   previewLinks: meta.slideOptions.previewLinks,   progress: meta.slideOptions.progress,   rtl: meta.slideOptions.rtl,   showNotes: meta.slideOptions.showNotes,   shuffle: meta.slideOptions.shuffle,   slideNumber: meta.slideOptions.slideNumber,   totalTime: meta.slideOptions.totalTime,   touch: meta.slideOptions.touch,   transition: meta.slideOptions.transition,   transitionSpeed: meta.slideOptions.transitionSpeed,   viewDistance: meta.slideOptions.viewDistance,   width: meta.slideOptions.width } || {}  const view = $('.reveal') 

Patch:
patch: @@ -72,7 +72,56 @@ const defaultOptions = {
 
 // options from yaml meta
 const meta = JSON.parse($('#meta').text())
-var options = meta.slideOptions || {}
+var options = {
+  autoPlayMedia: meta.slideOptions.autoPlayMedia,
+  autoSlide: meta.slideOptions.autoSlide,
+  autoSlideStoppable: meta.slideOptions.autoSlideStoppable,
+  backgroundTransition: meta.slideOptions.backgroundTransition,
+  center: meta.slideOptions.center,
+  controls: meta.slideOptions.controls,
+  controlsBackArrows: meta.slideOptions.controlsBackArrows,
+  controlsLayout: meta.slideOptions.controlsLayout,
+  controlsTutorial: meta.slideOptions.controlsTutorial,
+  defaultTiming: meta.slideOptions.defaultTiming,
+  display: meta.slideOptions.display,
+  embedded: meta.slideOptions.embedded,
+  fragmentInURL: meta.slideOptions.fragmentInURL,
+  fragments: meta.slideOptions.fragments,
+  hash: meta.slideOptions.hash,
+  height: meta.slideOptions.height,
+  help: meta.slideOptions.help,
+  hideAddressBar: meta.slideOptions.hideAddressBar,
+  hideCursorTime: meta.slideOptions.hideCursorTime,
+  hideInactiveCursor: meta.slideOptions.hideInactiveCursor,
+  history: meta.slideOptions.history,
+  keyboard: meta.slideOptions.keyboard,
+  loop: meta.slideOptions.loop,
+  margin: meta.slideOptions.margin,
+  maxScale: meta.slideOptions.maxScale,
+  minScale: meta.slideOptions.minScale,
+  minimumTimePerSlide: meta.slideOptions.minimumTimePerSlide,
+  mobileViewDistance: meta.slideOptions.mobileViewDistance,
+  mouseWheel: meta.slideOptions.mouseWheel,
+  navigationMode: meta.slideOptions.navigationMode,
+  overview: meta.slideOptions.overview,
+  parallaxBackgroundHorizontal: meta.slideOptions.parallaxBackgroundHorizontal,
+  parallaxBackgroundImage: meta.slideOptions.parallaxBackgroundImage,
+  parallaxBackgroundSize: meta.slideOptions.parallaxBackgroundSize,
+  parallaxBackgroundVertical: meta.slideOptions.parallaxBackgroundVertical,
+  preloadIframes: meta.slideOptions.preloadIframes,
+  previewLinks: meta.slideOptions.previewLinks,
+  progress: meta.slideOptions.progress,
+  rtl: meta.slideOptions.rtl,
+  showNotes: meta.slideOptions.showNotes,
+  shuffle: meta.slideOptions.shuffle,
+  slideNumber: meta.slideOptions.slideNumber,
+  totalTime: meta.slideOptions.totalTime,
+  touch: meta.slideOptions.touch,
+  transition: meta.slideOptions.transition,
+  transitionSpeed: meta.slideOptions.transitionSpeed,
+  viewDistance: meta.slideOptions.viewDistance,
+  width: meta.slideOptions.width
+} || {}
 
 const view = $('.reveal')
path: public/js/slide.js