A bug in the Sundown and Redcarpet markdown parsers may lead to XSS (danlec.com) 6 points by _jomo 11y ago ↗ HN
[–] captn3m0 11y ago ↗ No libraries listed on babelmark (or the versions used there) seem to be affected: http://johnmacfarlane.net/babelmark2/?normalize=1&text=_danl... [–] danlec 11y ago ↗ Redcarpet would only exhibit the bug if the autolink extension were enabled, i.e. if it would render danlec@danlec.com as a link. [–] captn3m0 11y ago ↗ Interesting. That makes it much more clearer. I was confused as to why links were being generated without angular brackets being involved.
[–] danlec 11y ago ↗ Redcarpet would only exhibit the bug if the autolink extension were enabled, i.e. if it would render danlec@danlec.com as a link. [–] captn3m0 11y ago ↗ Interesting. That makes it much more clearer. I was confused as to why links were being generated without angular brackets being involved.
[–] captn3m0 11y ago ↗ Interesting. That makes it much more clearer. I was confused as to why links were being generated without angular brackets being involved.
3 comments
[ 3.4 ms ] story [ 29.8 ms ] thread