Inject javascript into markDown

[fschade]

Steps to reproduce

1. create space
2. edit description
3. add [link](javascript:alert('aaa')) as content
4. click the link in the rendered markdown

Expected behaviour

web should prevent to inject javascript or other possible dynamic contents.

Actual behaviour

javascript can be injected and executed from/for all space members

Solution

for now we sanitize the md rendered content and restrict those options, as a long term goal the backend also should handle those situations and strip out potential code parts.

[C0rby]

as a long term goal the backend also should handle those situations and strip out potential code parts.

I don't think that this is necessary or a good idea. You might want to sync markdown files with html img tags and so on but we don't want to display that in the spaces description. I think it makes sense to just let the frontend sanitize the content before displaying.