[Internal] is domPurify.sanitize necessary? about atom-ide-datatip HOT 6 CLOSED

In case of a datatip, where content doesn't come only from a language server (which could still be considered a vector) or codebase itself (but is also sourced from other areas of a project, including external dependencies), I would say it's good to have.

from atom-ide-datatip.

I think security here isn't an issue. Atom runs offline and a user installs a package by themselves. using sanitize may cause removing some HTML code that is necessary to show the content correctly.
#57

from atom-ide-datatip.

Atom runs offline

What do you mean?

a user installs a package by themselves

I wouldn't suspect a package, it runs in Atom anyway, similarly with a language server (although in this case it could get a bit more complicated), but these have dependencies.

using sanitize may cause removing some HTML code that is necessary to show the content correctly.

We should probably investigate first. Does atom-ide-ui suffer from similar issue, it's using the same solution to sanitize datatip?

from atom-ide-datatip.

IMO it’s better to be secure by default. You don’t know where the input is sourced from, so you can’t be sure it’s safe. A provider doesn’t need to be malicious to send unsafe content, it could just be assuming this package will sanitise everything. The provider itself could be sourcing the content from anywhere, including online sources.

Better would be a flag on the message / provider that the provider can use to say “yeah, I claim this is safe to use without sanitising”. This means any security issues are because the provider itself is malicious (in which case it can do whatever it likes anyway), or because the provider has a bug (so unsafe unsantised content would be its concern, not this packages). I believe VS Code offers something like this.

from atom-ide-datatip.

Yes, "secure by default" is a good approach.

Message/provider setting to turn sanitising off sounds good. However, it may encourage "fixes" with least resistance, which we can prevent. Unless a convincing case reveals itself, we shouldn't hurry with implementation of the flag.

from atom-ide-datatip.

I guess the replies make sense. I will close this.

from atom-ide-datatip.