mirror/tiptap
1
0
Fork 0
mirror of https://github.com/ueberdosis/tiptap.git synced 2025-01-10 22:25:22 +08:00
Code Issues Actions 5 Packages Projects Releases Wiki Activity
5,998 Commits 64 Branches 5,715 Tags 88 MiB
e6947bad2d
Commit Graph

3 Commits

Author SHA1 Message Date
Cameron Hessler
e6947bad2d fix(extension-youtube) fix lint 2023-11-20 18:48:22 +01:00
Cameron Hessler
1bd714a408 fix(extension-youtube) change regex to disallow non-youtube domains 2023-11-20 18:48:22 +01:00
Cameron Hessler
04a11355a7 fix(extension-youtube) XSS risk with src tag 
Fixes risks outline in #4600 by verifying that any src urls are valid
youtube URLs before rendering as HTML. My thoughts are that this attack
vector would be difficult to use because the attacker would have to have
a way to manipualte the TipTap payload in a manner that bypasses the
youtube extension's `setYoutubeVideo` command, which already checks for
valid URLs.
 2023-11-20 18:48:22 +01:00