Hi folks, this issue is just an advisory if you're using markup in your production code. There was an XSS issue where under certain circumstances, we didn't escape strings. This is fixed on the latest commit.
This only affect ,@(...). To the best of our knowledge, there's no escaping issues with ,(...).
In particular, in the old version the following will result in the alert message being shown.
(let ((val "<script>alert(1)</script>"))
(markup:write-html
<a>,@(list val)</a>)))
In the fixed version this will correctly render as: <a><script>alert(1)</script></a>.
Consider using quick-patch to pull in the latest version of this project:
(quick-patch:register "https://github.com/moderninterpreters/markup" "0d094d3cdefa6d714a3d094b7cddd02e944d64fd")
Hi folks, this issue is just an advisory if you're using markup in your production code. There was an XSS issue where under certain circumstances, we didn't escape strings. This is fixed on the latest commit.
This only affect
,@(...). To the best of our knowledge, there's no escaping issues with,(...).In particular, in the old version the following will result in the alert message being shown.
In the fixed version this will correctly render as:
<a><script>alert(1)</script></a>.Consider using quick-patch to pull in the latest version of this project: