You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Currently, to display the generated Markdown, we are using dangerouslySetInnerHTML which has some complex implications for security. To be truly cautious, it would be nice to use DOMPurify to sanitize all contributed blog posts. isomorphic-dompurify is probably the best library to use due to server side rendering. https://github.com/kkomelin/isomorphic-dompurify There may need to be a bit of wrangling with the Next.js build configuration due to including this library. kkomelin/isomorphic-dompurify#54
The text was updated successfully, but these errors were encountered:
We manually approve all markdown before merging. If one of our contributors wanted to be malicious (with 0 important cookies), they could just add a full html page.
Currently, to display the generated Markdown, we are using
dangerouslySetInnerHTML
which has some complex implications for security. To be truly cautious, it would be nice to useDOMPurify
to sanitize all contributed blog posts.isomorphic-dompurify
is probably the best library to use due to server side rendering. https://github.com/kkomelin/isomorphic-dompurify There may need to be a bit of wrangling with theNext.js
build configuration due to including this library. kkomelin/isomorphic-dompurify#54The text was updated successfully, but these errors were encountered: