toolito / nodebb-plugin-colors Goto Github PK

On version 0.6.1 don't work.

This plugin allows things that are not colors to be inserted into the CSS for an element. This can allow complex phishing attacks, and in the worst case, XSS.

The solution would be to only explicitly whitelist hexcodes, rgba, and CSS-color-words for input in the color field.

This plugin should not be enabled on anyone's site until this is fixed.

the plugin makes code bocks to fail
writing this

`````` ok ok```

will end with
ok
undefined

some other times you will get code instead