Support rich formatting (e.g. markdown) in objectives and their notes about peoplemath HOT 3 CLOSED

Links in objectives should probably be unclickable and differently-coloured in edit mode, because it would be ambiguous whether clicking a link in an objective would open the link or edit the objective.

The edit dialog should contain a preview of the rendered objective and notes.

All links should open in a new window/tab.

from peoplemath.

I should also note here that security would be a major consideration in deciding how to implement this.

Content would have to be put through some sort of rendering library in the client, and then the resulting HTML included in the DOM, through an innerHTML binding or similar. This raises the potential for XSS vulnerabilities.

I believe Angular has some sanitization functionality that would help mitigate against this. However, I'd want to seek a security review of the proposed approach before implementing if possible, just to make sure I haven't missed anything.

https://angular.io/guide/security#preventing-cross-site-scripting-xss

from peoplemath.

I asked for some security advice internally regarding this feature.

I was told that we should be able to trust Angular's built-in sanitizer to mitigate XSS vulnerabilities that might otherwise arise from passing untrusted input to a Markdown library (most of which don't seem to sanitize their outputs -- e.g. Marked docs, Showdown docs).

It was also suggested that I could consider coupling this with DOMPurify in a restrictive configuration. This would add a further defence in depth against XSS vulnerabilities, as well as providing an easy way to restrict the Markdown features used, via a HTML tag allow-list.

The intent of this feature is basically just to enable the user to add very simple formatting like italics, bold and links; I wouldn't want to allow, for example, large heading tags to be injected in objectives by Markdown ## directives or similar. So overall this seems like quite an attractive approach.

DOMPurify would also allow us to achieve other things, like ensuring all links open in a new window. It should also be able to strip links in edit mode.

from peoplemath.