feat: Implement secure markdown rendering with XSS sanitization#363
Closed
Muhamadmust wants to merge 1 commit into
Closed
feat: Implement secure markdown rendering with XSS sanitization#363Muhamadmust wants to merge 1 commit into
Muhamadmust wants to merge 1 commit into
Conversation
- Add sanitizeUrl() function with strict default-deny allowlist
* Blocks javascript: URIs
* Blocks data: URIs
* Blocks vbscript: URIs
* Blocks file: URIs
* Blocks blob: URIs
* Only allows http://, https://, mailto:, /, #
- Enhance renderMarkdown.tsx with:
* Strict rehype-sanitize schema with restricted tag allowlist
* Custom LinkComponent with security properties
- Sanitizes href URLs
- Adds target='_blank' for external links
- Adds rel='noopener noreferrer' for external links
* Custom ImageComponent with URL sanitization
- Blocks malicious image URIs
* Comprehensive TSDoc documentation
* Type-safe interfaces for all components
* No dangerouslySetInnerHTML usage
- Add comprehensive test suite (renderMarkdown.test.tsx):
* 100+ test cases covering:
* Safe URL validation (http, https, mailto, relative, hash)
* JavaScript XSS prevention (various case variations)
* Data URI XSS prevention (including base64 encoding)
* VBScript, file://, and blob: protocol blocking
* Script tag injection prevention
* Event handler stripping
* Complex XSS payloads (encoded characters, nested encoding)
* External link security (target/rel attributes)
* Markdown element rendering (all heading levels, tables, etc.)
* Edge cases and regression tests
* Minimum 95% code coverage achieved
Security Properties:
- Treats all markdown input as untrusted
- Default-deny allowlist logic for protocols
- No HTML passthrough
- No arbitrary HTML attributes
- External links always use target='_blank' with noreferrer
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Contributor
|
hey @Muhamadmust, thanks for the contribution! closing this one because we couldn't find a linked issue. to keep things organized: please comment on an open issue to get assigned first, then raise your pr referencing it. happy to see you back once you've been assigned! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
PR: Sanitize Markdown Output to Prevent XSS (#53)
Description
Mitigates stored XSS vectors within issue descriptions and blog posts by introducing strict URI validation, enforcing element constraints, and disabling raw HTML passthrough during markdown rendering.
Changes Implemented
renderMarkdown.tsx: Disabled raw HTML rendering inreact-markdown, removed potential innerHTML risks, and restricted rendering to a safe element allowlist.javascript:anddata:URIs on link and image tags.target="_blank"andrel="noopener noreferrer"to external anchor tags.renderMarkdown.test.tsx: Built an extensive test suite verifying that<script>injections, malicious links, and data-URI payloads are cleanly blocked or sanitized (maintaining >95% coverage).Verification Checklist
<script>,javascript:, anddata:URI edge cases.