Skip to content

Escape substitution placeholders to avoid input collisions #274

@mondeja

Description

@mondeja

This is a known low impact vulnerability and/or bug that probably is shared with Python-Markdown.

An attacker could add an input which some of its characters match placeholder content. To avoid this, escape placeholder characters in input with text.replace(STX, '\\u0002').replace(ETX, '\\u0003'), so they never find raw STX nor ETX.

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions