{Common} Some HTML codes are not recognized by the editor

[codejamtc]

URL:
https://challenges.topcoder-dev.com/projects/16539/challenges/09595f69-fdc5-4ba5-8401-1727121daa7e/edit

Reproduction Steps:

1. Open the application and Login as a valid user (jcori)
2. Select a Project > Click Launch New > Select a design challenge type and fill all > Click 'Create Challenge'
3. Enter the below code to the editor

<form action="#" method="post">
    <div>
         <label for="name">Text Input:</label>
         <input type="text" name="name" id="name" value="" tabindex="1" />
    </div>

    <div>
         <h4>Radio Button Choice</h4>

         <label for="radio-choice-1">Choice 1</label>
         <input type="radio" name="radio-choice-1" id="radio-choice-1" tabindex="2" value="choice-1" />

     <label for="radio-choice-2">Choice 2</label>
         <input type="radio" name="radio-choice-2" id="radio-choice-2" tabindex="3" value="choice-2" />
    </div>

  <div>
    <label for="select-choice">Select Dropdown Choice:</label>
    <select name="select-choice" id="select-choice">
      <option value="Choice 1">Choice 1</option>
      <option value="Choice 2">Choice 2</option>
      <option value="Choice 3">Choice 3</option>
    </select>
  </div>

  <div>
    <label for="textarea">Textarea:</label>
    <textarea cols="40" rows="8" name="textarea" id="textarea"></textarea>
  </div>

  <div>
      <label for="checkbox">Checkbox:</label>
    <input type="checkbox" name="checkbox" id="checkbox" />
    </div>

  <div>
      <input type="submit" value="Submit" />
    </div>
</form>

4. Check the option buttons

Actual Result:

• Some HTML codes are not recognized by the editor

Expected Result:

• Most of the HTML codes are recognized by the editor, so this code snippet should also recognized

Device/OS:

• Device(s): Laptop
• Resolution: 1366 x 768
• Operating System: Windows 10 64bit (1909, 18363.815)

Browser Information:

• Browser(s): Google Chrome 81.0.4044.138

[jmgasper]

@rootelement - This is kind of an odd one, but could potentially cause problems with the community app. Not sure how far we want to drill down on this one.

[rootelement]

Not sure what we want to do here. I think we should only be accepting actual markdown. Pasting in HTML should be escaped I'm assuming.

[jmgasper]

@rootelement - Yeah, it's a weird one. I tried another MD editor and it also parses the HTML:

https://pandao.github.io/editor.md/

We use SimpleMDE (https://simplemde.com/)

[codejamtc]

Hi @jmgasper

I checked the demo version of the SimpleMDE (https://simplemde.com/) there the radio button code is working.

<div>
         <h4>Radio Button Choice</h4>

         <label for="radio-choice-1">Choice 1</label>
         <input type="radio" name="radio-choice-1" id="radio-choice-1" tabindex="2" value="choice-1" />

     <label for="radio-choice-2">Choice 2</label>
         <input type="radio" name="radio-choice-2" id="radio-choice-2" tabindex="3" value="choice-2" />
    </div>

[codejamtc]

@jmgasper I think I got the issue here

If we paste the code like below; editor will identify the radio button part as a code snippet;

<div>
         <h4>Radio Button Choice</h4>

         <label for="radio-choice-1">Choice 1</label>
         <input type="radio" name="radio-choice-1" id="radio-choice-1" tabindex="2" value="choice-1" />

     <label for="radio-choice-2">Choice 2</label>
         <input type="radio" name="radio-choice-2" id="radio-choice-2" tabindex="3" value="choice-2" />
    </div>

But if we remove the spaces in the above code then it will be recognized as radio buttons

<div>
         <h4>Radio Button Choice</h4>
         <label for="radio-choice-1">Choice 1</label>
         <input type="radio" name="radio-choice-1" id="radio-choice-1" tabindex="2" value="choice-1" />
     <label for="radio-choice-2">Choice 2</label>
         <input type="radio" name="radio-choice-2" id="radio-choice-2" tabindex="3" value="choice-2" />
</div>

But the radio buttons are rendered differently, Thanks

[codejamtc]

Markdown editors are Vulnerable against the XSS attacks

1. Since this allows HTML,

hello <a name="n" href="javascript:alert('xss')">*you*</a>

2. But preventing HTML input won't solve the issue, check below code snippet (It's markdown code)

> hello <a name="n"
> href="javascript:alert('xss')">*you*</a>

https://monosnap.com/file/JhvtkBTjHUCylTgNWoiWlG4cEja0N9

I think the solution is to filter the output, rather the input. After the input text is converted into full-fledged HTML, you can then reliably apply the correct XSS filters to remove any dangerous or malicious content.

Sorry to share the insights/comments after the challenge ends

[acshields]

@rootelement - chiming in late here, but what was the conclusion on this issue? We accept the limitation, or does it need to be fixed? Just trying to lay out some iterative improvement plans w/ Vikas right now.