status-im
/
codimd
mirror of https://github.com/status-im/codimd.git
2
0
Fork 0
Code Issues Projects Releases Wiki Activity

fix: strip html tags for gist id to avoid stored XSS on showing error [Security Issue] 

Signed-off-by: Max Wu <jackymaxj@gmail.com>
This commit is contained in:
Max Wu 2021-06-02 09:30:54 +08:00
parent 282fcab4f7
commit 6966881152
1 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
public/js/extra.js
View File

@ -330,7 +330,12 @@ export function finishView (view) {
})
// gist
view.find('code[data-gist-id]').each((key, value) => {
if ($(value).children().length === 0) { $(value).gist(window.viewAjaxCallback) }
if ($(value).children().length === 0) {
// strip HTML tags to avoid stored XSS
const gistid = value.getAttribute('data-gist-id')
value.setAttribute('data-gist-id', stripTags(gistid))
$(value).gist(window.viewAjaxCallback)
}
})
// sequence diagram
const sequences = view.find('div.sequence-diagram.raw').removeClass('raw')