Details
-
Type:
Bug
-
Status: Resolved
-
Priority:
Major
-
Resolution: Fixed
-
Affects Version/s: 4.8.0
-
Fix Version/s: None
-
Component/s: app.editor
-
Labels:None
Description
Problem Statement : Hue Uses HueUtils.deXSS method to sanitize the String and prevent XSS attack. But it doesn't honor onerror, onclick and another tags which can be injected into DOM, we only honor <script and </script> tag .
So I am proposing an change to this by using the Sanitize-html NPM package :