Mirror
/
zulip
mirror of https://github.com/zulip/zulip.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity
zulip/zerver
History
Rohitt Vashishtha 3bdc8bbaa5 CVE-2018-9986: Fix XSS issues with frontend markdown processor. 
This fixes a set of XSS issues with Zulip's frontend markdown
processor, which is used in a limited set of contexts, such as local
echo of messages and the drafts feature.

The implementation of several syntax elements, including the <em>
syntax, user and stream mentions, and some others failed to properly
escape the content inside the syntax.

Fix this, and add tests for each corrected code path.

Thanks to w2w for reporting this issue.
 		2018-04-12 09:46:37 -07:00
..
fixtures CVE-2018-9986: Fix XSS issues with frontend markdown processor. 2018-04-12 09:46:37 -07:00
lib slack import: Implement custom profile fields. 2018-04-10 13:28:53 -07:00
management scripts: Remove the depreciated script 'postgres-reset-sequences'. 2018-04-10 13:07:14 -07:00
migrations org settings: Change default realm description to empty string. 2018-04-06 15:15:47 -07:00
templatetags mypy: Migrate templatetags/minified_js.py to python3.5 annotations. 2018-03-12 11:23:30 -07:00
tests csp_reports: Add endpoint to handle logging of reports sent by clients. 2018-04-11 23:01:13 +05:30
tornado websockets: Fix race condition in CSRF token initialization. 2018-03-31 09:29:56 -07:00
views csp_reports: Add endpoint to handle logging of reports sent by clients. 2018-04-11 23:01:13 +05:30
webhooks webhooks/splunk: Update docs to conform to style guide. 2018-04-05 23:28:27 -07:00
worker mypy: Remove need for cast by using ConcreteQueueWorker TypeVar. 2018-03-11 15:34:11 -07:00
__init__.py
…
apps.py zerver: Use Python 3 syntax for typing. 2017-11-28 16:49:36 -08:00
context_processors.py cleanup: Remove the legacy Dropbox file upload integration. 2018-04-11 11:39:48 -07:00
decorator.py decorators: Log custom HTTP headers in webhook requests. 2018-03-30 13:37:35 -07:00
filters.py zerver: Use Python 3 syntax for typing. 2017-11-28 16:49:36 -08:00
forms.py forms: Fix missing translation tag for disposable emails. 2018-03-15 14:43:40 -07:00
logging_handlers.py test_logging_handlers: Mock out `git describe` because can be slow. 2018-03-23 18:24:51 -07:00
middleware.py mypy: Rewrite some middleware annotations to use ViewFuncT. 2018-03-17 23:25:05 +00:00
models.py org settings: Change default realm description to empty string. 2018-04-06 15:15:47 -07:00
signals.py emails: Fix notify_new_login emails have unserializable context. 2017-12-22 16:34:18 -05:00
static_header.txt
…
storage.py mypy: Improve typing for ManifestStaticFilesStorage monkeypatch. 2017-12-08 19:00:18 -08:00