Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Explain security risk of using this plugin #210

Merged
merged 1 commit into from
Oct 10, 2021
Merged

Explain security risk of using this plugin #210

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
13 changes: 12 additions & 1 deletion README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,17 @@

Add support for [Markdown]. This plugin uses [marked] as its render engine.

## Important note on security

By default, this plugin contains a potential security issue: **It is possible to inject Markdown containing Unsafe HTML that will not be sanitized**

This issue might not affect you because you checked the content of the markdown before using this plugin, but it's still a risk

There are two solutions to avoid those issues:

1. First solution is to enable option `dompurify: true`, which will sanitize the rendered HTML. The side effect of this solution is that it will break any [tag plugin](https://hexo.io/docs/tag-plugins) (aka `{% codeblock %}`). This explains why the safer option has not been enabled by default
2. Second solution is to migrate to [hexo-renderer-markdown-it](https://github.com/hexojs/hexo-renderer-markdown-it/) which is safe by default and does not suffer from the same limitations

## Installation

``` bash
Expand Down Expand Up @@ -34,7 +45,7 @@ marked:
autolink: true
mangle: true
sanitizeUrl: false
dompurify: false,
dompurify: false
headerIds: true
lazyload: false
prependRoot: true
Expand Down