HTML escaping in code review comments #3442

New Issue

GiteaMirror · 2025-11-02T05:13:03-06:00

GiteaMirror commented

2025-11-02 05:13:03 -06:00

Originally created by @ptman on GitHub (Jun 7, 2019).

Gitea version (or commit ref): 1.8.2
Git version:
Operating system: docker
Database (use [x]):
- PostgreSQL
- MySQL
- MSSQL
- SQLite
Can you reproduce the bug at https://try.gitea.io:
- Yes https://try.gitea.io/basti/gitea/pulls/1/files#issuecomment-11854
- No
- Not relevant
Log gist:

Description

XSS in code review comments.
tag not escaped: https://try.gitea.io/basti/gitea/pulls/1/files#issuecomment-11854

Originally created by @ptman on GitHub (Jun 7, 2019). - Gitea version (or commit ref): 1.8.2 - Git version: - Operating system: docker - Database (use `[x]`): - [x] PostgreSQL - [ ] MySQL - [ ] MSSQL - [ ] SQLite - Can you reproduce the bug at https://try.gitea.io: - [x] Yes https://try.gitea.io/basti/gitea/pulls/1/files#issuecomment-11854 - [ ] No - [ ] Not relevant - Log gist: ## Description XSS in code review comments. <br> tag not escaped: https://try.gitea.io/basti/gitea/pulls/1/files#issuecomment-11854

GiteaMirror closed this issue

2025-11-02 05:13:04 -06:00

GiteaMirror commented

2025-11-02 05:13:04 -06:00

@ptman commented on GitHub (Jun 7, 2019):

Hmm.. it wasn't escaped here either, since markdown allows html?

@ptman commented on GitHub (Jun 7, 2019): Hmm.. it wasn't escaped here either, since markdown allows html?

GiteaMirror commented

2025-11-02 05:13:04 -06:00

@silverwind commented on GitHub (Jun 7, 2019):

Markdown allows a limited subset of HTML (thought <script> etc should not work), see the spec.

@silverwind commented on GitHub (Jun 7, 2019): Markdown allows a limited subset of HTML (thought `<script>` etc should not work), see the [spec](https://spec.commonmark.org/0.29/#raw-html).

GiteaMirror commented

2025-11-02 05:13:05 -06:00

@zeripath commented on GitHub (Jun 11, 2019):

@ptman I can't seem to get there to be a sanitisation problem. The resultant HTML is completely sanitised on render the only thing I would say is that downstream users of the comments could end up mis-sanitising.

@zeripath commented on GitHub (Jun 11, 2019): @ptman I can't seem to get there to be a sanitisation problem. The resultant HTML is completely sanitised on render the only thing I would say is that downstream users of the comments could end up mis-sanitising.

GiteaMirror commented

2025-11-02 05:13:05 -06:00

@ptman commented on GitHub (Jun 12, 2019):

ok, my bad. Maybe every place that can take markdown input should have a link to syntax to remind?

@ptman commented on GitHub (Jun 12, 2019): ok, my bad. Maybe every place that can take markdown input should have a link to syntax to remind?

GiteaMirror referenced this issue

2025-11-02 09:45:50 -06:00

Admin users should not be able to see private repositories on users profile page #11723

Sign in to join this conversation.