Markdown unicode bug - XSS

[Hossein Hussain]

When submitting a lab we can add comments which uses markdown syntax. There is an XSS vulnerability there when using unicode to bypass the filter. This is an example: text;">text</a>

[aalfred]

that's just HTML entities, not Unicode. Either way, the easiest solution is a whitelist for "http://" and "https://", rather than trying to blacklist "javascript:".

[aalfred]

Fixed in mistune v0.7.2, released Feb 2016. Ignore my comment in #155 saying it's still vulnerable, I misread the output (expected "", got "jav&#x61;script:alert('hello'&#x29;").

Just bump the dependency and you can close both issues.

[Víctor López Juan]

Thanks for reporting this! I've patched it up in production in a quick-and-dirty way (just whitelisting links that start with 'h'). We should have a proper fix for the next release.

[Víctor López Juan]

[ fix ] Bump mistune to fix #154, #155

→ <<cset c0ef84f013dc>>