Review lint warning: warning 'v-html' directive can lead to XSS attack vue/no-v-html #105
Description
The component components/Markdown.vue uses the v-html directive that can lead to XSS attack.
I have added an ESLint comment to hide the warning here:
<template>
<!-- eslint-disable vue/no-v-html -->
<div class="prose" v-html="sanitizedDescription" />
</template>
Because we are sanitizing the description with the sanitizeDescription function:
async function sanitizeDescription () {
// Get the original not sanitized markdown string.
const description = markdown(props.source);
// Replace the img src's with a random id and return a map
// of these ids mapped to the original url.
const [filteredDescriptionWithImageIds, imageIdUrlMap] = filterDescriptionImagesWithRandomIds(description);
// Get the image data using the backend's image proxy.
const imageIdDataUrlMap = await getImageDataUrlsFromUrls(imageIdUrlMap);
// Replace the img id's with the proxied sources.
sanitizedDescription.value = replaceDescriptionImageIdsWithDataUrls(filteredDescriptionWithImageIds, imageIdDataUrlMap);
}
But I wonder if we are still vulnerable to other XSS attacks. We should double-check it. We could use a library like RisXSS.