Skip to content

Conversation

mtorromeo
Copy link

To fix #46 a simple logic was applied to SearchHTMLBody to only allow script tags if they contained the string application/ld+json but there are other structured data scripts that are not harmful.

One such script is application/json+trustpilot (see https://help.trustpilot.com/s/article/Add-a-structured-data-snippet-for-Automatic-Feedback-Service?language=en_US)

I modified the logic to allow a more generic type pattern of application/*+json and application/json+*. The code also looks for the string type="..." as this prevents scripts like <script type="application/javascript" whatever="application/ld+json"> to bypass the filter.

IMHO this would be better implemented as a configurable pattern, but as a simple alternative this should be flexible enough for now.

Another alternative would be to only block script tags where the type attribute is either missing or one of application/javascript or text/javascript since these are in theory the only potentially dangerous types. This would work better against a script written like this: <script type="application/javascript" type="application/ld+json"> which would still be included in the email.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Script tag of application/ld+json detected as malicius but it is not malicius
1 participant