mirror of
https://github.com/hedgedoc/hedgedoc.git
synced 2025-05-12 22:26:08 -04:00
refactor: use iframes for gist embedding instead of gist-embed
The used library gist-embed relies on GitHub Gist's JSONP endpoint which is a risk for XSS injection. By adding untrusted content from GitHub into the DOM it also follows very bad practises. Using the iframe embedding has the disadvantage of not having the proper height for the frame auto-loaded, but the security benefits are worth it. Signed-off-by: Erik Michelson <github@erik.michelson.eu>
This commit is contained in:
parent
d2585fbd3b
commit
0636b5c20b
6 changed files with 8 additions and 23 deletions
|
@ -22,4 +22,3 @@ const $ = require('jquery')
|
|||
window.jQuery = $
|
||||
window.$ = $
|
||||
require('bootstrap')
|
||||
require('gist-embed/gist-embed.min')
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue