mirror of https://github.com/status-im/codimd.git
fix: remove string.js for sucurity issue
1. Upgrade Imgur to fix npm install 2. Upgrade less version for security 3. Change package name in package.json to fit npm package.json rule Signed-off-by: BoHong Li <a60814billy@gmail.com>
This commit is contained in:
parent
22b29c42fe
commit
67707d097f
|
@ -13,7 +13,8 @@ var async = require('async')
|
|||
var moment = require('moment')
|
||||
var DiffMatchPatch = require('@hackmd/diff-match-patch')
|
||||
var dmp = new DiffMatchPatch()
|
||||
var S = require('string')
|
||||
|
||||
const {stripTags} = require('../../utils/string')
|
||||
|
||||
// core
|
||||
var config = require('../config')
|
||||
|
@ -338,7 +339,7 @@ module.exports = function (sequelize, DataTypes) {
|
|||
title = meta.title
|
||||
} else {
|
||||
var h1s = $('h1')
|
||||
if (h1s.length > 0 && h1s.first().text().split('\n').length === 1) { title = S(h1s.first().text()).stripTags().s }
|
||||
if (h1s.length > 0 && h1s.first().text().split('\n').length === 1) { title = stripTags(h1s.first().text()) }
|
||||
}
|
||||
if (!title) title = 'Untitled'
|
||||
return title
|
||||
|
@ -368,7 +369,7 @@ module.exports = function (sequelize, DataTypes) {
|
|||
if (/^tags/gmi.test($(value).text())) {
|
||||
var codes = $(value).find('code')
|
||||
for (let i = 0; i < codes.length; i++) {
|
||||
var text = S($(codes[i]).text().trim()).stripTags().s
|
||||
var text = stripTags($(codes[i]).text().trim())
|
||||
if (text) rawtags.push(text)
|
||||
}
|
||||
}
|
||||
|
|
|
@ -1,5 +1,5 @@
|
|||
{
|
||||
"name": "CodiMD",
|
||||
"name": "codimd",
|
||||
"version": "1.3.1",
|
||||
"description": "Realtime collaborative markdown notes on all platforms.",
|
||||
"main": "app.js",
|
||||
|
@ -19,7 +19,7 @@
|
|||
"@hackmd/codemirror": "^5.41.2",
|
||||
"@hackmd/diff-match-patch": "^1.1.1",
|
||||
"@hackmd/idle-js": "^1.0.1",
|
||||
"@hackmd/imgur": "^0.4.0",
|
||||
"@hackmd/imgur": "^0.4.1",
|
||||
"@hackmd/js-sequence-diagrams": "^0.0.1-alpha.2",
|
||||
"@passport-next/passport-openid": "^1.0.0",
|
||||
"archiver": "^2.1.1",
|
||||
|
@ -117,7 +117,6 @@
|
|||
"spin.js": "^2.3.2",
|
||||
"sqlite3": "^4.0.1",
|
||||
"store": "^2.0.12",
|
||||
"string": "^3.3.3",
|
||||
"tedious": "^1.14.0",
|
||||
"toobusy-js": "^0.5.1",
|
||||
"turndown": "^5.0.1",
|
||||
|
@ -184,7 +183,7 @@
|
|||
"html-webpack-plugin": "4.0.0-beta.2",
|
||||
"imports-loader": "^0.8.0",
|
||||
"jsonlint": "^1.6.2",
|
||||
"less": "^2.7.1",
|
||||
"less": "^3.9.0",
|
||||
"less-loader": "^4.1.0",
|
||||
"mini-css-extract-plugin": "^0.4.1",
|
||||
"mocha": "^5.2.0",
|
||||
|
|
|
@ -30,7 +30,7 @@ import {
|
|||
|
||||
import { saveAs } from 'file-saver'
|
||||
import List from 'list.js'
|
||||
import S from 'string'
|
||||
import unescapeHTML from 'lodash/unescape'
|
||||
|
||||
const options = {
|
||||
valueNames: ['id', 'text', 'timestamp', 'fromNow', 'time', 'tags', 'pinned'],
|
||||
|
@ -397,7 +397,7 @@ function buildTagsFilter (tags) {
|
|||
for (let i = 0; i < tags.length; i++) {
|
||||
tags[i] = {
|
||||
id: i,
|
||||
text: S(tags[i]).unescapeHTML().s
|
||||
text: unescapeHTML(tags[i])
|
||||
}
|
||||
}
|
||||
filtertags = tags
|
||||
|
|
|
@ -13,9 +13,13 @@ require('prismjs/components/prism-gherkin')
|
|||
import Prism from 'prismjs'
|
||||
import hljs from 'highlight.js'
|
||||
import PDFObject from 'pdfobject'
|
||||
import S from 'string'
|
||||
import { saveAs } from 'file-saver'
|
||||
|
||||
import escapeHTML from 'lodash/escape'
|
||||
import unescapeHTML from 'lodash/unescape'
|
||||
|
||||
import {stripTags} from '../../utils/string'
|
||||
|
||||
require('./lib/common/login')
|
||||
require('../vendor/md-toc')
|
||||
var Viz = require('viz.js')
|
||||
|
@ -157,7 +161,7 @@ export function renderTags (view) {
|
|||
|
||||
function slugifyWithUTF8 (text) {
|
||||
// remove html tags and trim spaces
|
||||
let newText = S(text).trim().stripTags().s
|
||||
let newText = stripTags(text.toString().trim())
|
||||
// replace all spaces in between to dashes
|
||||
newText = newText.replace(/\s+/g, '-')
|
||||
// slugify string to make it valid for attribute
|
||||
|
@ -492,22 +496,22 @@ export function finishView (view) {
|
|||
value: code
|
||||
}
|
||||
} else if (reallang === 'haskell' || reallang === 'go' || reallang === 'typescript' || reallang === 'jsx' || reallang === 'gherkin') {
|
||||
code = S(code).unescapeHTML().s
|
||||
code = unescapeHTML(code)
|
||||
result = {
|
||||
value: Prism.highlight(code, Prism.languages[reallang])
|
||||
}
|
||||
} else if (reallang === 'tiddlywiki' || reallang === 'mediawiki') {
|
||||
code = S(code).unescapeHTML().s
|
||||
code = unescapeHTML(code)
|
||||
result = {
|
||||
value: Prism.highlight(code, Prism.languages.wiki)
|
||||
}
|
||||
} else if (reallang === 'cmake') {
|
||||
code = S(code).unescapeHTML().s
|
||||
code = unescapeHTML(code)
|
||||
result = {
|
||||
value: Prism.highlight(code, Prism.languages.makefile)
|
||||
}
|
||||
} else {
|
||||
code = S(code).unescapeHTML().s
|
||||
code = unescapeHTML(code)
|
||||
const languages = hljs.listLanguages()
|
||||
if (!languages.includes(reallang)) {
|
||||
result = hljs.highlightAuto(code)
|
||||
|
@ -902,7 +906,7 @@ export function scrollToHash () {
|
|||
|
||||
function highlightRender (code, lang) {
|
||||
if (!lang || /no(-?)highlight|plain|text/.test(lang)) { return }
|
||||
code = S(code).escapeHTML().s
|
||||
code = escapeHTML(code)
|
||||
if (lang === 'sequence') {
|
||||
return `<div class="sequence-diagram raw">${code}</div>`
|
||||
} else if (lang === 'flow') {
|
||||
|
|
|
@ -2,9 +2,10 @@
|
|||
/* global serverurl, moment */
|
||||
|
||||
import store from 'store'
|
||||
import S from 'string'
|
||||
import LZString from 'lz-string'
|
||||
|
||||
import escapeHTML from 'lodash/escape'
|
||||
|
||||
import wurl from 'wurl'
|
||||
|
||||
import {
|
||||
|
@ -276,8 +277,8 @@ function parseToHistory (list, notehistory, callback) {
|
|||
notehistory[i].fromNow = timestamp.fromNow()
|
||||
notehistory[i].time = timestamp.format('llll')
|
||||
// prevent XSS
|
||||
notehistory[i].text = S(notehistory[i].text).escapeHTML().s
|
||||
notehistory[i].tags = (notehistory[i].tags && notehistory[i].tags.length > 0) ? S(notehistory[i].tags).escapeHTML().s.split(',') : []
|
||||
notehistory[i].text = escapeHTML(notehistory[i].text)
|
||||
notehistory[i].tags = (notehistory[i].tags && notehistory[i].tags.length > 0) ? escapeHTML(notehistory[i].tags).split(',') : []
|
||||
// add to list
|
||||
if (notehistory[i].id && list.get('id', notehistory[i].id).length === 0) { list.add(notehistory[i]) }
|
||||
}
|
||||
|
|
|
@ -0,0 +1,7 @@
|
|||
'use strict'
|
||||
|
||||
function stripTags(s) {
|
||||
return s.replace(RegExp(`</?[^<>]*>`, 'gi'), '')
|
||||
}
|
||||
|
||||
exports.stripTags = stripTags
|
35
yarn.lock
35
yarn.lock
|
@ -33,10 +33,10 @@
|
|||
resolved "https://registry.yarnpkg.com/@hackmd/idle-js/-/idle-js-1.0.1.tgz#89079a76d9c7bda87029660a708e72fbb2be3605"
|
||||
integrity sha512-yuv9BBdA5rk4TpmSrsdNgkLIyRt73hWyBEs7PhWhIozFcNv66JfUzXqA0eT3ToXX0163aVnbpHeJZRvcYy5Seg==
|
||||
|
||||
"@hackmd/imgur@^0.4.0":
|
||||
version "0.4.0"
|
||||
resolved "https://registry.yarnpkg.com/@hackmd/imgur/-/imgur-0.4.0.tgz#e5716f6a7a12e8011ceb57f46369fcc958623e19"
|
||||
integrity sha512-519G+fXIDu1LUwPU32nerot4wuP2pSDEBysOj9nX6IYL5qom/lo6vmp3bp0bg7SbtHWvmjZEDOermCrlqR18xw==
|
||||
"@hackmd/imgur@^0.4.1":
|
||||
version "0.4.1"
|
||||
resolved "https://registry.yarnpkg.com/@hackmd/imgur/-/imgur-0.4.1.tgz#9d51dafc4fd0baf36a8fb7a8a5c23f2f660d3ad2"
|
||||
integrity sha512-zvAt/4drM+nZG/yM12hJ7/DtkPffw/fzvr8oDp6twg5a04/HBoGha28vYrZP4fV/a5ZAAnRzxRRbeADxRfsGfA==
|
||||
dependencies:
|
||||
glob "^7.1.3"
|
||||
request "^2.88.0"
|
||||
|
@ -1976,7 +1976,7 @@ cliui@^4.0.0:
|
|||
strip-ansi "^4.0.0"
|
||||
wrap-ansi "^2.0.0"
|
||||
|
||||
clone@^2.1.1:
|
||||
clone@^2.1.1, clone@^2.1.2:
|
||||
version "2.1.2"
|
||||
resolved "https://registry.yarnpkg.com/clone/-/clone-2.1.2.tgz#1b7f4b9f591f1e8f83670401600345a02887435f"
|
||||
integrity sha1-G39Ln1kfHo+DZwQBYANFoCiHQ18=
|
||||
|
@ -5414,19 +5414,21 @@ less-loader@^4.1.0:
|
|||
loader-utils "^1.1.0"
|
||||
pify "^3.0.0"
|
||||
|
||||
less@^2.7.1:
|
||||
version "2.7.3"
|
||||
resolved "https://registry.yarnpkg.com/less/-/less-2.7.3.tgz#cc1260f51c900a9ec0d91fb6998139e02507b63b"
|
||||
integrity sha512-KPdIJKWcEAb02TuJtaLrhue0krtRLoRoo7x6BNJIBelO00t/CCdJQUnHW5V34OnHMWzIktSalJxRO+FvytQlCQ==
|
||||
less@^3.9.0:
|
||||
version "3.9.0"
|
||||
resolved "https://registry.yarnpkg.com/less/-/less-3.9.0.tgz#b7511c43f37cf57dc87dffd9883ec121289b1474"
|
||||
integrity sha512-31CmtPEZraNUtuUREYjSqRkeETFdyEHSEPAGq4erDlUXtda7pzNmctdljdIagSb589d/qXGWiiP31R5JVf+v0w==
|
||||
dependencies:
|
||||
clone "^2.1.2"
|
||||
optionalDependencies:
|
||||
errno "^0.1.1"
|
||||
graceful-fs "^4.1.2"
|
||||
image-size "~0.5.0"
|
||||
mime "^1.2.11"
|
||||
mime "^1.4.1"
|
||||
mkdirp "^0.5.0"
|
||||
promise "^7.1.1"
|
||||
request "2.81.0"
|
||||
source-map "^0.5.3"
|
||||
request "^2.83.0"
|
||||
source-map "~0.6.0"
|
||||
|
||||
levn@^0.3.0, levn@~0.3.0:
|
||||
version "0.3.0"
|
||||
|
@ -5982,7 +5984,7 @@ mime@1.4.1:
|
|||
resolved "https://registry.yarnpkg.com/mime/-/mime-1.4.1.tgz#121f9ebc49e3766f311a76e1fa1c8003c4b03aa6"
|
||||
integrity sha512-KI1+qOZu5DcW6wayYHSzR/tXKCDC5Om4s1z2QJjDULzLcmf3DvzS7oluY4HCTrc+9FiKmWUgeNLg7W3uIQvxtQ==
|
||||
|
||||
mime@^1.2.11:
|
||||
mime@^1.4.1:
|
||||
version "1.6.0"
|
||||
resolved "https://registry.yarnpkg.com/mime/-/mime-1.6.0.tgz#32cd9e5c64553bd58d19a568af452acff04981b1"
|
||||
integrity sha512-x0Vn8spI+wuJ1O6S7gnbaQg8Pxh4NNHb7KSINmEWKiPE4RKOplvijn+NkmYmmRgP68mc70j2EbeTFRsrswaQeg==
|
||||
|
@ -8046,7 +8048,7 @@ request-promise-native@^1.0.5:
|
|||
stealthy-require "^1.1.1"
|
||||
tough-cookie "^2.3.3"
|
||||
|
||||
request@2.81.0, request@2.x, request@^2.61.0, request@^2.81.0, request@^2.86.0, request@^2.87.0, request@^2.88.0:
|
||||
request@2.x, request@^2.61.0, request@^2.81.0, request@^2.83.0, request@^2.86.0, request@^2.87.0, request@^2.88.0:
|
||||
version "2.88.0"
|
||||
resolved "https://registry.yarnpkg.com/request/-/request-2.88.0.tgz#9c2fca4f7d35b592efe57c7f0a55e81052124fef"
|
||||
integrity sha512-NAqBSrijGLZdM0WZNsInLJpkJokL72XYjUpnB0iwsRgxh7dB6COrHnTBNwN0E+lHDAJzu7kLAkDeY08z2/A0hg==
|
||||
|
@ -8829,11 +8831,6 @@ string-width@^3.0.0:
|
|||
is-fullwidth-code-point "^2.0.0"
|
||||
strip-ansi "^5.1.0"
|
||||
|
||||
string@^3.3.3:
|
||||
version "3.3.3"
|
||||
resolved "https://registry.yarnpkg.com/string/-/string-3.3.3.tgz#5ea211cd92d228e184294990a6cc97b366a77cb0"
|
||||
integrity sha1-XqIRzZLSKOGEKUmQpsyXs2anfLA=
|
||||
|
||||
string_decoder@^1.0.0, string_decoder@^1.1.1:
|
||||
version "1.2.0"
|
||||
resolved "https://registry.yarnpkg.com/string_decoder/-/string_decoder-1.2.0.tgz#fe86e738b19544afe70469243b2a1ee9240eae8d"
|
||||
|
|
Loading…
Reference in New Issue