[Discussion] XSS Attack on lemmy.world and Voyager security

Voyager should NOT be vulnerable, we use a different Markdown parser.

(Note: Speculation below...)

The markdown parser in lemmy-ui is building DOM nodes with strings, which can be vulnerable to exploits like this.

In contrast, Voyager uses Remark for markdown parsing, specifically a subset of remark-gfm

The only extension on these standard, widely used and tested markdown components is for community links to work (like !voyagerapp@lemmy.world) since they're Lemmy-specific. You can see that code here. Note that we parse into an abstract syntax tree, not HTML strings. Parsing into an abstract syntax tree is much more resistant to this kind of exploit.

Voyager communicates directly with the backend api of the lemmy server you're trying to connect to, so wouldn't have been effected by that attack, as it happened on their UI.