Conversation
|
@seanbudd, you write:
I can see that you have fixed such issues in the Russian change log. But I guess other languages are impacted. Though, I understand the need to sanitize documentation's HTML; my remark is not a criticism of this approach. |
Searching for angle brackets in markdown files should make it easy to find these issues. The iframe tag in the Russian source caused the rest of the document to be escaped - i.e. half the document appeared as HTML source code in the browser. For other instances, it is just the fake "tag" that was removed. |
…6043) Follow up to nvaccess#15945 Summary of the issue: Translators can add arbitrary HTML to markdown translations files. This is a stored XSS risk Description of user facing changes Should be none - however see known issues Description of development approach Used the python bindings for the Rust Ammonia sanitization library Testing strategy: Tested building docs, diffed HTML results between this PR and beta. Known issues with pull request: The sanitization deletes any HTML tags that are not recognized. This includes using angle brackets around words, e.g.: <minor>. If these are wrapped by code formatting these are correctly escaped: e.g. `<minor>` While english files are mostly correct, many translated files do not wrap text with angle brackets with code formatting. This means certain parts of translated documentation will be stripped, i.e. <major>.<minor>.<patch> becomes ..
Link to issue number:
Follow up to #15945
Summary of the issue:
Translators can add arbitrary HTML to markdown translations files.
This is a stored XSS risk
Description of user facing changes
Should be none - however see known issues
Description of development approach
Used the python bindings for the Rust Ammonia sanitization library
Testing strategy:
Tested building docs, diffed HTML results between this PR and beta.
Known issues with pull request:
The sanitization deletes any HTML tags that are not recognized.
This includes using angle brackets around words, e.g.:
<minor>.If these are wrapped by code formatting these are correctly escaped: e.g.
`<minor>`While english files are mostly correct, many translated files do not wrap text with angle brackets with code formatting.
This means certain parts of translated documentation will be stripped, i.e.
<major>.<minor>.<patch>becomes..Code Review Checklist: