GHSA-9g7v-h3pr-4qm8: 
Python vulnerability analysis and mitigation

Summary

ui.editor holds its value as HTML and renders it unchanged in every browser that shows the editor. The rich-text editor in the browser strips pasted markup down to plain text, but this is the only barrier: a client that sends messages to the server directly, bypassing the editor, can set the value to arbitrary HTML, including elements with JavaScript event handlers. The server accepted such a value and forwarded it to every other editor showing the same value. Unlike ui.html and ui.markdown, ui.editor had neither a sanitizing default nor a sanitize option.

Impact

Applications are affected if they show one user's editor content in another user's editor, for example a shared note, a message board or a document that several users edit, typically by binding the editor's value to app.storage.general, a shared object or a database record. Anyone who can open the page containing the editor can then run JavaScript in the browsers of the other users who view it: without authentication if the page is public, otherwise as any logged-in user. Users who already have the page open are affected immediately, without any interaction. The damage is bounded by what a script in the victim's session can do, such as reading the page, acting on the victim's behalf or changing what they see. Applications in which each user only sees their own editor content are not affected, because an attacker can only target their own browser.

Patches

Fixed in NiceGUI 3.19.0. ui.editor has a new sanitize parameter, similar to ui.html and ui.markdown. By default, every browser sanitizes the editor content it receives with DOMPurify before displaying it, and sanitize=False restores the previous behavior for trusted content. The value on the server is still what the client sent, so applications that store it or pass it on to other HTML-rendering elements should sanitize it on the server themselves, as described below. Upgrade to 3.19.0 or later.

Workarounds

If upgrading is not immediately possible, sanitize the editor content on the server before it is shared with other users, for example with a sanitizer like nh3 or html-sanitizer in the forward function of the binding or in the on_change handler that stores the value. Configure the sanitizer to keep the markup the editor produces itself, such as <div> line breaks and style attributes, and to remove scripts and event handler attributes. This remains advisable after upgrading for applications that pass the stored value on to other places.