status-im
/
codimd
mirror of https://github.com/status-im/codimd.git
2
0
Fork 0
Code Issues Projects Releases Wiki Activity

fix: strip html tags for gist file, gist line, gist highlight line, gist show loading attrtributes 

Signed-off-by: Max Wu <jackymaxj@gmail.com>
This commit is contained in:
Max Wu 2021-06-09 15:05:04 +08:00
parent 6966881152
commit 2eefe7706f
1 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
public/js/extra.js
View File

@ -334,6 +334,14 @@ export function finishView (view) {
// strip HTML tags to avoid stored XSS
const gistid = value.getAttribute('data-gist-id')
value.setAttribute('data-gist-id', stripTags(gistid))
const gistfile = value.getAttribute('data-gist-file')
if (gistfile) value.setAttribute('data-gist-file', stripTags(gistfile))
const gistline = value.getAttribute('data-gist-line')
if (gistline) value.setAttribute('data-gist-line', stripTags(gistline))
const gisthighlightline = value.getAttribute('data-gist-highlight-line')
if (gisthighlightline) value.setAttribute('data-gist-highlight-line', stripTags(gisthighlightline))
const gistshowloading = value.getAttribute('data-gist-show-loading')
if (gistshowloading) value.setAttribute('data-gist-show-loading', stripTags(gistshowloading))
$(value).gist(window.viewAjaxCallback)
}
})