Riley D.
said:
Okay, so, I've added some further sanitization. In general, things I'm okay with you doing with this direct HTML access:
Doing basic formatting with the style attribute, adding <strong>, <em>, etc.
Adding elements such as <img> tags, <divs>, etc., including styling and external images. At some point in the future these may be restricted to only images hosted on Roll20. I realize that this does open up a vector currently where you could load an "img" with a src that is really a GET request to an outside service...so maybe that needs to be changed. I dunno, for now I'm going to leave it since there's no easy way to access the URLs of your uploaded images. But I wouldn't count on this staying for too long.
Things I'm not okay with:
Any execution of arbitrary Javascript whatsoever. If there are still vectors allowing this after this latest update (which should have shored up things like putting javascript: links in <a> tags) please let me know so I can continue to shore it up.
Two-way AJAX requests...again you can abuse the <img> tags right now to do GET requests which may need to be fixed, but you definitely shouldn't be able to load in outside data and use it in the app.
You might send me a PM with examples of what you're doing so I know what I'm missing :-)
EDIT: Oh, also, I fixed the scripts editor so now if you have HTML in the editor it won't cause the editor to not load.
You look to have fixed all my arbitrary javascript execution points, I will have a look later and see if I can break it any more. I notice you still have css in there I would suggest limiting or even abstracting the CSS as you can make the app unusable very easily. The biggist culprites for this would be position, although it lets me make a UI without JavaScript that UI is pointless so you may as well fillter out the position related stuff before someone works out how to make a Phishing script.