3 ms·
The contents of the ‘file’ in this code are a single Markdown cell in ipynb format. Because Markdown allows arbitrary HTML, in trusted mode, we can
by gravypod 4y ago
The contents of the ‘file’ in this code
are a single Markdown cell in ipynb
format. Because Markdown allows
arbitrary HTML, in trusted mode, we can
inject any HTML code we want into the
webview.
This is a very common foot-gun with markdown. Unfortunate that they did not sanitize the HTML output from their renderer.
- zemnmez 4y agoThe logic here is somewhat sound. VSCode does sanitize by default, but Jupyter notebooks effectively need to run Python code on your machine to work. At that point (this is the meaning of trusted mode), it's not really worth protecting yourself against XSS.