Security: does Editor.js sanitize the text and links before displaying it? about editor.js

[collimarco]

I made some testing now and unfortunately Editor.js seems vulnerable:

1. Just try to add a link and type javascript:alert('test') as the URL
2. The href is added to the page without any sanitization
3. Save and reload the document from JSON
4. Again, the JSON is converted to HTML without any sanitization (you will see <a href="javascript:alert('test')"> in the code)

[collimarco]

Another test:

1. Add some code to the text in the saved JSON, like "This is a paragraph <script> alert('xss') </script>"
2. If you load the Editor.js with that JSON, the script is injected in the page
3. However from my test the script doesn't seem to be executed, probably because the HTML is appended to the DOM (and I think that append or similar functions don't execute the scripts)

[collimarco]

Editor.js sanitizes all content in several cases: on render, on paste, and on save.
https://editorjs.io/inline-tool-sanitizing/

This sentence is strange, because it's not the behavior that I am seeing.

[ConnectGrid]

Not sure which server-side language you use, but that shouldn't matter much. The output of EditorJS is JSON, so you convert that to whatever object representation your server-side language supports, sanitize each block, and then convert back to JSON. This should be fairly easy to do in the server side programming, and you have full control over it.

[collimarco]

you convert that to whatever object representation your server-side language supports, sanitize each block, and then convert back to JSON

I've done that properly for our application, but it's really a tedious task: you need to unwrap the JSON and parse each field. And you need to implement that for each block that you use, it's not a single function.

I guess that many applications are vulnerable and simply load the saved JSON data into Editor.js.