RS-22478: fix stored XSS in metro HTML labels#51
Conversation
Sanitise as_html label content with DOMPurify before rendering it, keeping the render-as-HTML feature while stripping scripts/handlers. Adds the dompurify dependency. Rebuilt the inst/htmlwidgets bundle. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
This is perhaps risker than the other changes as it has bigger potential to break existing outputs. The standard R tests should provide some assurance. Check them before promoting the R server. |
|
You're right this causes a lot of diffs. Also by default rhtmlMetro is run in an iframe (which is already safe). Will look into checks around calls to boxIframeless in flipFormat where we create custom widgets for Standard R outputs. |
|
On further inspection, the iframe gives functional isolation (a widget's CSS/JS/global vars don't clobber the rest of Displayr) but no XSS isolation. Its same-origin and non-sandboxed. So we'll try this again with sanitization (instead of removal of html elements). |
OK |
This reverts commit f95425c.
2 participants
Sanitise as_html label content with DOMPurify before rendering it, keeping the render-as-HTML feature while stripping scripts/handlers. Adds the dompurify dependency.