@tdurieux/anonymous_github Vulnerable to XSS via Unsanitized GitHub Repository Content Rendering in Anonymous GitHub Origin
### Summary Anonymous GitHub fetches repository content (e.g., markdown files) from GitHub's API and renders it without sanitization. On the client side, markdown is parsed with `marked` (with `sanitize: false`) and injected into the DOM via `$sce.trustAsHtml()` + `ng-bind-html`, bypassing AngularJS's built-in XSS protection. An attacker can craft a malicious GitHub repository whose README executes arbitrary JavaScript in the Anonymous GitHub origin. ### Details #### README fetched from GitHub API The server fetches the README via GitHub's REST API and stores the raw markdown in MongoDB: ```typescript // https://github.com/tdurieux/anony
- Auf 2.3.0 aktualisieren
Veröffentlicht Aktualisiert