Bug HTML render trong forum - the img va script chay ngay

Chao moi nguoi,

Minh phat hien forum nay render thang HTML/JS trong noi dung bai viet va comment - khong filter, khong escape gi ca. Vi du chen test-bold hay la chay luon khi nguoi khac mo bai.

Day la doan repro minh dan thu (chi la test, khong gay hai), admin xem giup nen fix the nao - nen dung thu vien sanitize (nhu DOMPurify) hoac escape het HTML khi render.

Cam on!

--- repro ---

--- end repro ---