[ZEPPELIN-4952] Markdown interpreter can be used to store XSS in notebooks.

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 0.10.0
• Assignee: Prabhjyot Singh
• Reporter: Paulo Pacheco
• Created: 13/Jul/20 18:48
• Updated: 08/Feb/21 03:33
• Resolved: 08/Feb/21 03:26

Description

The %md interpreter can be used to store XSS in notebooks. These cells are automatically loaded by the user when opening the notebook, so, no manual user interaction is needed.
 
Also, it doesn't matter if the cell has already a result or not.
 
 
%md

1. foo <script>alert(String.fromCharCode(88,83,83))</script>