The Markdown Preview can exploited to execute arbitrary code.
The root cause of the vulnerability is the current usage of markdown-it to render html then subsequently adding the output to the DOM via innerHtml without sanitizing. Moreover, there are several potential xss sinks within the Theia code base that could potentially be exploited in a similar fashion (e.g. innerHtml, dangerouslySetInnerHtml). Would the community be open to accepting contributions to mitigate these vulnerabilities, and accompanying lint rules that would bar future usages of xss sinks?
Would the community be open to accepting contributions to mitigate these vulnerabilities, and accompanying lint rules that would bar future usages of xss sinks?
I would be fine with it. @marcdumais-work @eclipse-theia/ecd-theia-committers any concerns?
I think the ideal solution would be to run any remote HTML content as webviews: https://github.com/eclipse-theia/theia/issues/6562 And let them do whatever they want.
Here's another piece of code where this problem is relevant:
Would the community be open to accepting contributions to mitigate these vulnerabilities
I don't see any drawbacks, this would be great!
Here's another piece of code where this problem is relevant:
This should be already solved here:
https://github.com/eclipse-theia/theia/blob/master/packages/vsx-registry/src/browser/vsx-extensions-model.ts#L208
@caseyflynn-google I created a PR where I sanitize the md. However this does not contain any solutions regarding lint rules. Another PR for that is still welcome.
@caseyflynn-google Is anything else has to be done?
Sorry for the delayed response, this looks great! I am digging into a few options for flagging usage of xss sinks via eslint rules. https://github.com/mozilla/eslint-plugin-no-unsanitized looks promising, but I will need to reach out to the owner to ensure they are willing to accept a contribution to enable running the rule over typescript: https://github.com/mozilla/eslint-plugin-no-unsanitized/issues/111#issuecomment-599557165 It looks like the code is licensed under MPL-2.0 would that be a problem?
It looks like the code is licensed under MPL-2.0 would that be a problem?
@marcdumais-work ? fyi we will use it only as a dev dependency.
@marcdumais-work ? fyi we will use it only as a dev dependency.
MPL-1.1/MPL-2.0 (Mozilla Public License) is fine even as runtime dependency, being part of the Eclipse Foundation approved license list
Has this had a CVE assigned to it?
Most helpful comment
I would be fine with it. @marcdumais-work @eclipse-theia/ecd-theia-committers any concerns?