• Robert Speicher's avatar
    Limit `style` attribute on `th` and `td` elements to specific properties · 228cf4f6
    Robert Speicher authored
    Previously we whitelisted the entire `style` attribute on `th` and `td`
    elements, in order to allow Markdown table alignment to work. But this
    opened us up to a potential exploit by allowing a malicious user to
    define properties besides `text-align` in the attribute.
    
    We now remove everything except `text-align: (center|left|right)`.
    228cf4f6
rs-issue-36098.yml 100 Bytes