sanitize all incoming data about giveth-dapp HOT 6 CLOSED

I think the problem is, no backend serves the dapp, so we can't really include CSRF protection. That means, the client can never be trusted. And so we need to secure Feathers models and services. Already made a story for that in the feathers repro.

I'm really curious how Dapps are solving this issue. Actually blockchain could be really good for this, as a CSRF token is some kind of transaction based on trust.

from giveth-dapp.

add sanitizing to feathers for all data

from giveth-dapp.

okay, so react will sanitize anything unless we use dangerourslySetHtml, which we do for the dacs/campaigns/milestone descriptions field as we are using QuillJS.

from giveth-dapp.

Still the case in ViewCampaign, ViewDAC and ViewMilestone. Moving back to backlog (we really should solve this)

from giveth-dapp.

Ok so what exactly should we still solve here?

We cannot sanitize on the client, it can never ever be trusted. If we've implemented sanitizing on feathers, that should do it.

This dangerourslySetHtml is kind of (Facebook) bullshit if you know the source of the data (it just sets innerHtml but Facebook wants to own the web and thought it funny to name it differently).

We know the data always comes from Feathers and is sanitized already. And if by some hack attack that data doesn't come from Feathers, then still QuillJS is as far as I tried incapible of executing JS. And even if that would be hacked, then if the user saves it will be sanitized in Feathers again.

:-)

from giveth-dapp.

Good enough for me, I tried to do some injections but could not.

from giveth-dapp.