filterHTMLTags does not properly filter Html tags (XSS)

[antonio-morales]

Dear Pandao team,

I would like to report a security vulnerability in Editor.md.

Summary:

The "filterHTMLTags" function does not properly filter Html tags, leading to XSS.

Description:

The sanitizer in "filterHTMLTags" function in editormd.js is broken:

editor.md/editormd.js

Line 3828 in 63786e6

html = html.replace(new RegExp("\<\s*" + tag + "\s*([^\>]*)\>([^\>]*)\<\s*\/" + tag + "\s*\>", "igm"), "");

As a result, an attacker could exploit this to inject client-side scripts into web pages that use Editor.md.

Steps to reproduce:

For example, in Firefox you can use:
<script >alert(31337)</script >

Supporting material:
POC1:

POC2:

[antonio-morales]

Any updates on this?

[alromh87]

Please try:
https://github.com/alromh87/editor.md/

Should be fixed with latest commit, let my know if its not