BB code or html in item_details about kemana-directory HOT 3 CLOSED

Hi,

1. Unfortunately no. I want to avoid XSS. But in the future release, I may add MarkDown???
2. I think you are correct. To fix the problem:

Remove the following line:

And replace the following line:

To this line:

from kemana-directory.

Thank you! I believe it fix the bug.

About HTML. Well people are used to know simple html tags like <b <img some formatting tags like color, size.
Of course it would be amazing to have description editor something like in reddit or here. (Allowed most important tags, and formating even from copy/paste text)

To prevent XSS maybe we could just ignore other tags except our "whitelisted"?
and/or just replace <script> to <script< everywhere in user input? I don't know much about XSS so i could be wrong.

PS. Why BB code is disabled and what made you to decide it (just curious) ?

from kemana-directory.

Hi,
Unfortunately, preventing XSS is not that easy, eg, you can still do XSS by using:

• <a href="javascript:alert(1)">
• <div onclick="alert(1)">
• <img src="javascript:alert(1)"> (doesn't actually work anymore in modern browsers)
• <div style="background-image: url(javascript:alert(1))"> (doesn't work anymore)
  Source: https://stackoverflow.com/questions/53427381/is-using-jquery-parsehtml-to-remove-script-tags-enough-to-prevent-xss-attacks

So, I think it's easier 😜 to remove the HTML support all together, except for backend.

About BBCode. I removed it because my implementation of BBCode was flawed.

In the future, I may re-add BBCode or MarkDown, or simply use plain text....?

from kemana-directory.