Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Adds sanitize to conversation messages #2213

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

pmcneill
Copy link

Conversation messages rely on the output-side rendering to escape any malicious HTML. This adds a sanitize_field call to the body property to clean up the saved data and ensure that API-provided messages are safe as well.

Test plan

  • Open browser developer tools network panel
  • Send a conversation message to someone and verify it's received
  • In Chrome, copy the request out as a cURL command. Edit the message in the JSON to include some HTML with an onClick event.
  • Invoke the cURL command to send another message
  • Verify that the HTML was stripped

Conversation messages rely on the output-side rendering to escape any
malicious HTML.  This adds a sanitize_field call to the body property
to clean up the saved data and ensure that API-provided messages are
safe as well.

Test plan
  - Open browser developer tools network panel
  - Send a conversation message to someone and verify it's received
  - In Chrome, copy the request out as a cURL command.  Edit the
    message in the JSON to include some HTML with an onClick event.
  - Invoke the cURL command to send another message
  - Verify that the HTML was stripped
@CLAassistant
Copy link

CLAassistant commented May 24, 2023

CLA assistant check
All committers have signed the CLA.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants