Merge pull request #206 from SISheogorath/fix/CVE-2019-15499

Don't accept sandbox attribute
2019-10-22 19:30:23 +02:00
parent 145285abf6 8494f6a085
commit 3db757754f
1 changed files with 1 additions and 1 deletions
--- a/public/js/render.js
+++ b/public/js/render.js
@@ -20,7 +20,7 @@ whiteList['style'] = []
 // allow kbd tag
 whiteList['kbd'] = []
 // allow ifram tag with some safe attributes
-whiteList['iframe'] = ['allowfullscreen', 'name', 'referrerpolicy', 'sandbox', 'src', 'width', 'height']
+whiteList['iframe'] = ['allowfullscreen', 'name', 'referrerpolicy', 'src', 'width', 'height']
 // allow summary tag
 whiteList['summary'] = []
 // allow ruby tag