👍 This seems pretty significant.

I assume this project is dead. I cant see letting an XSS go for this long otherwise. I have moved to a new Lib in my project.

@matt- any recommendation for alternatives?

https://github.com/jonschlinkert/remarkable has been great for me.

@matt- thanks a ton!

That moment when you realize you didn't comment on an open issue, but rather an open PR. Whelp.

when will this be pulled?

+1 Can this please be merged in so we can remove the advisory?

+1

+1

@matt- Remarkable looks great (very very clean) but it's about 6x the size of Marked. For some use-cases (client-side) it seems like Marked would be preferable on those grounds (though for anything else I'm probably going to be using remarkable given the focus on performance).

the question is, where is the repo maintainer?

Perhaps on vacation?

+1

Vacation for a year? Must be nice.

@matt or anyone else... Any chance that you would be willing to help the Modernizr js (https://github.com/Modernizr/Modernizr) swap out its dependency from Marked to Remarkable? I'm too new at programming javascript to take on the task myself.

This appears to be no longer reproducible. I believe the author fixed it and just ignored this PR. Can anyone still reproduce it with the latest version of Marked?

EDIT: I was mistaken, this is still valid. Just had some more post processing that was causing it to not be reproducible in my app.

"Latest commit 88ce4df on Jul 31, 2015" This issue is not resolved and has not been even been touched.

The exact example you gave is the XSS issue. (Put that HTML in a browser and click on it.) javascript: (in any form even with html entities) should be blocked in sanitize mode.

Example where marked works correctly:

> var md = require("marked");
> md.setOptions({sanitize: true})
> md("[URL](javascript:alert(1))");
'<p></p>\n'

Example this PR resolves with bad entities:

> var md = require("marked");
> md.setOptions({sanitize: true})
> md("[URL](javascript&#58document;alert(1))");
'<p><a href="javascript&#58document;alert&#40;1&#41;">URL</a></p>\n'

If you think this is still some how resolved please read this blog to better understand the issue:
https://snyk.io/blog/marked-xss-vulnerability/

From the first sentence in this PR: "With the sanitize option on" This lib has a sanitize mode that is intended to block normal HTML and prevent xss. https://github.com/chjj/marked#sanitize

It also filters "javascript:" and "vbscript:" as intended in this mode. This is an example of bypassing that with html entities.

Executing javascript (an XSS) is much MUCH worse than "plain old hyperlinks". This is an abandoned project with an open and very clear security issue.. not exactly what I consider FUD.

@matt- I was able to reproduce this in indeed. I may have been confused due to the fact that post-process links and images, mitigating this issue.

@matt- sorry I work with @mvhenten and we thought it was resolved but it was only not affecting us due to post-processing. This is still a valid issue. Thanks for the test cases.