Comments (4)
commented on May 17, 2024
Thanks for flagging this. It will be a bit of a balance: Currently the entire configuration string that's passed on to the child windows is stripped of tags and a number of expressions that can be used to create XSS attacks - in order to facilitate passing HTML to popout windows (not necessarily important for the title, but for components within it as well) I think we'd need to loosen the XSS policy a bit...
Sorry for the delay in that, but this needs a bit of testing to not open up attack vectors.
from golden-layout.
DinisCruz
commented on May 17, 2024
Hi, allowing the set of icons on top of tabs (and other customisations) via html is very dangerous (i.e. XSS injection points), would it be possible to define (as an parameter) a number of extra classes to be added to a particular tab?
from golden-layout.
commented on May 17, 2024
Hi @iver56 - thanks again for pointing this out. The overall issue is fixed in the just released version 1.0.6..
@DinisCruz - Now that the configuration is passed through localStorage - would there still be a security concern?
from golden-layout.
DinisCruz
commented on May 17, 2024
@hoxton-one sorry I had no time to look at this.
from golden-layout.
Related Issues (20)
- Is it possible to set the height of the container higher than the browser window?
- Maximizing in the official "Adding items to a predefined layout" CodePen doesn't work HOT 2
- Having issue on tab overlaping
- `ContentItem.getItemsById` is absent in code but present in docs
- Migrating stackCreated event in golden-layout 2 HOT 1
- createAndInitContentItem() should take an unresolved config.
- No header controls in basic implementation HOT 3
- Bugs in negated `instanceof` expressions
- Unable to add child items
- How i can remove created DragSources?
- Popouts are not handled in loadLayout correctly
- popout not working when using with popoutWholeStack enabled
- The position when closing the tab when reopening it HOT 1
- Way to prevent tab drag to other component [HELP] HOT 1
- RTL Feature Support HOT 1
- isClose cause issue with dragging
- X3D content fails after dragging window
- Is it possible to simulate a new window on this page instead of using the browser implementation?
- it popout the whole application gets loaded in popup window
- Error: Component type not registered and BindComponentEvent handler not assigned HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from golden-layout.