prabhjyotsingh opened a new pull request #4045:
URL: https://github.com/apache/zeppelin/pull/4045
### What is this PR for?
Markdown interpreter can be used to store XSS in notebooks
The %md interpreter can be used to store XSS in notebooks. These cells are
automatically loaded by the user when opening the notebook, so, no manual user
interaction is needed.
Also, it doesn't matter if the cell has already a result or not.
```
%md
foo
<script>alert(String.fromCharCode(88,83,83))</script>
bar
<bold onclick='alert("a");'>qqq</bold>
```
### What type of PR is it?
[Bug Fix]
### What is the Jira issue?
* https://issues.apache.org/jira/browse/ZEPPELIN-4952
### How should this be tested?
* Use the above paragraph, and there should not be any XSS.
### Questions:
* Does the licenses files need update? n/a
* Is there breaking changes for older versions? n/a
* Does this needs documentation? n/a
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
[email protected]
