[SECURITY] stored xss in shared text content

[Cycloctane]

Describe the bug

FileCodeBox doesn't validate user input and sanitize output in shared text content, results in stored xss vulnerability. This allows attackers to inject and store malicious javascript or html codes, which can be automatically executed in the browsers of users who try to access a codebox.

PoC

An attacker can create a text codebox containing arbitrary javascript codes and trick potential victims into accessing it.

Xss script can be triggered on victim's browser immediately after victim click on sharing link or enters share code. There is no chance for victim to inspect its content before accessing a codebox.

Affected versions

<= 2.2

Additional context

CWE-79