security: wiki should only allow markdown files #217

New Issue

2026-05-26T18:39:55Z

jmiller commented

2026-05-26 18:39:55 +00:00

Summary

Wiki pages should only accept .md (Markdown) files. Currently there may not be sufficient validation preventing other file types from being stored in the wiki git repository.

Risk

If non-markdown files (HTML, JS, etc.) can be committed to the wiki repo, they could be rendered unsafely or used for XSS.

Requirements

Validate file extension on wiki page create/edit (web UI and API)
Reject non-.md files in wiki git push hooks
Audit existing wiki repos for non-markdown files

Authored-by: Claude Opus 4.6 (1M context) noreply@anthropic.com

## Summary Wiki pages should only accept .md (Markdown) files. Currently there may not be sufficient validation preventing other file types from being stored in the wiki git repository. ## Risk If non-markdown files (HTML, JS, etc.) can be committed to the wiki repo, they could be rendered unsafely or used for XSS. ## Requirements - [ ] Validate file extension on wiki page create/edit (web UI and API) - [ ] Reject non-.md files in wiki git push hooks - [ ] Audit existing wiki repos for non-markdown files --- *Authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>*

jmiller added the security label 2026-05-26 18:39:55 +00:00

jmiller commented

2026-05-26 18:57:19 +00:00

Deployed in v1.26.1-moko.05.05.00.

Authored-by: Claude Opus 4.6 (1M context) noreply@anthropic.com

Deployed in v1.26.1-moko.05.05.00. *Authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>*

jmiller closed this issue

2026-05-26 18:57:20 +00:00

Sign in to join this conversation.

Priority High

Type Security

Status —

Priority —

Type —

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: MokoConsulting/MokoGitea-APP#217