Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add URL validation for image upload by URL input #3222

Open
aujourdui opened this issue Jan 26, 2024 · 1 comment
Open

Add URL validation for image upload by URL input #3222

aujourdui opened this issue Jan 26, 2024 · 1 comment
Labels
Enhancement Enhance performance or improve usability of original features. Need Discussion Need discussion or investigation

Comments

@aujourdui
Copy link

aujourdui commented Jan 26, 2024

Version

Write the version that you are currently using.
@toast-ui/vue-editor: 3.2.3

Development Environment

Write the browser type, OS and so on.
Mas OS Sonoma14.0

Current Behavior

When we add image by URL input, it's fine to add image by URL such as "https" or "http". However, we can add an image by this URL input with data URL format such as data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAB3oAAAK1CAYAAAAuQ+8vAAABX2lDQ1...
スクリーンショット 2024-01-24 17 21 17

This is unexpected action but this URL input not covered by addImageBlobHook so it's difficult to validate it.

Expected Behavior

Write a description of the future action.

I propose this URL input validation by "https" and "http" to filter unexpected embedding dataURI.
It's not difficult and it's probably more secure.

@aujourdui aujourdui added Enhancement Enhance performance or improve usability of original features. Need Discussion Need discussion or investigation labels Jan 26, 2024
@aujourdui
Copy link
Author

Although I fixed this issue in my local and I tried to push, it occured below error. Do I need to have any permission to push and create a PR for this repository?

Permission to nhn/tui.editor.git denied to aujourdui. fatal: unable to access 'https://github.com/nhn/tui.editor.git/': The requested URL returned error: 403

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Enhancement Enhance performance or improve usability of original features. Need Discussion Need discussion or investigation
Projects
None yet
Development

No branches or pull requests

1 participant