From 9d4ede4cffae47b9fd81ffbd0f2edff47c29e224 Mon Sep 17 00:00:00 2001
From: Wu Cheng-Han <jacky_cute0808@hotmail.com>
Date: Sat, 26 Nov 2016 22:55:31 +0800
Subject: [PATCH] Fix possible XSS in yaml-metadata and turn using ejs escape
 syntax than external lib [Security Issue]

---
 lib/response.js         |  7 ++-----
 public/js/pretty.js     |  5 +----
 public/js/slide.js      |  3 ---
 public/views/disqus.ejs |  2 +-
 public/views/ga.ejs     |  2 +-
 public/views/head.ejs   |  2 +-
 public/views/pretty.ejs |  8 ++++----
 public/views/slide.ejs  | 10 +++++-----
 8 files changed, 15 insertions(+), 24 deletions(-)

diff --git a/lib/response.js b/lib/response.js
index 1a45d63a..b2d13988 100755
--- a/lib/response.js
+++ b/lib/response.js
@@ -186,7 +186,6 @@ function showPublishNote(req, res, next) {
             if (!meta) meta = {};
             var createtime = note.createdAt;
             var updatetime = note.lastchangeAt;
-            var text = S(body).escapeHTML().s;
             var title = models.Note.decodeTitle(note.title);
             title = models.Note.generateWebTitle(meta.title || title);
             var origin = config.serverurl;
@@ -197,7 +196,7 @@ function showPublishNote(req, res, next) {
                 createtime: createtime,
                 updatetime: updatetime,
                 url: origin,
-                body: text,
+                body: body,
                 useCDN: config.usecdn,
                 owner: note.owner ? note.owner.id : null,
                 ownerprofile: note.owner ? models.User.parseProfile(note.owner.profile) : null,
@@ -258,7 +257,6 @@ function actionInfo(req, res, note) {
     if (!meta) meta = {};
     var createtime = note.createdAt;
     var updatetime = note.lastchangeAt;
-    var text = S(body).escapeHTML().s;
     var title = models.Note.decodeTitle(note.title);
     var data = {
         title: meta.title || title,
@@ -572,7 +570,6 @@ function showPublishSlide(req, res, next) {
             if (!meta) meta = {};
             var createtime = note.createdAt;
             var updatetime = note.lastchangeAt;
-            var text = S(body).escapeHTML().s;
             var title = models.Note.decodeTitle(note.title);
             title = models.Note.generateWebTitle(meta.title || title);
             var origin = config.serverurl;
@@ -583,7 +580,7 @@ function showPublishSlide(req, res, next) {
                 createtime: createtime,
                 updatetime: updatetime,
                 url: origin,
-                body: text,
+                body: body,
                 meta: JSON.stringify(obj.meta || {}),
                 useCDN: config.usecdn,
                 owner: note.owner ? note.owner.id : null,
diff --git a/public/js/pretty.js b/public/js/pretty.js
index f43df90c..c1a471a1 100644
--- a/public/js/pretty.js
+++ b/public/js/pretty.js
@@ -4,9 +4,6 @@ require('../css/site.css');
 
 require('highlight.js/styles/github-gist.css');
 
-/* other vendors plugin */
-var S = require('string');
-
 var extra = require('./extra');
 var md = extra.md;
 var finishView = extra.finishView;
@@ -22,7 +19,7 @@ var scrollToHash = extra.scrollToHash;
 var preventXSS = require('./render').preventXSS;
 
 var markdown = $("#doc.markdown-body");
-var text = S(markdown.html()).unescapeHTML().s;
+var text = markdown.text();
 var lastMeta = md.meta;
 md.meta = {};
 var rendered = md.render(text);
diff --git a/public/js/slide.js b/public/js/slide.js
index a8411570..8d45219e 100644
--- a/public/js/slide.js
+++ b/public/js/slide.js
@@ -2,9 +2,6 @@ require('../css/extra.css');
 require('../css/site.css');
 require('../css/slide.css');
 
-/* other vendors plugin */
-var S = require('string');
-
 var extraModule = require('./extra');
 var md = extraModule.md;
 var updateLastChange = extraModule.updateLastChange;
diff --git a/public/views/disqus.ejs b/public/views/disqus.ejs
index ed991a41..cceaa85c 100644
--- a/public/views/disqus.ejs
+++ b/public/views/disqus.ejs
@@ -5,7 +5,7 @@ var disqus_config = function () {
 };
 (function() {
     var d = document, s = d.createElement('script');
-    s.src = '//<%- disqus %>.disqus.com/embed.js';
+    s.src = '//<%= disqus %>.disqus.com/embed.js';
     s.setAttribute('data-timestamp', +new Date());
     (d.head || d.body).appendChild(s);
 })();
diff --git a/public/views/ga.ejs b/public/views/ga.ejs
index 180832d1..66d4acd9 100644
--- a/public/views/ga.ejs
+++ b/public/views/ga.ejs
@@ -12,7 +12,7 @@
     m.parentNode.insertBefore(a, m)
 })(window, document, 'script', '//www.google-analytics.com/analytics.js', 'ga');
 
-ga('create', '<%- GA %>', 'auto');
+ga('create', '<%= GA %>', 'auto');
 ga('send', 'pageview');
 </script>
 <% } %>
\ No newline at end of file
diff --git a/public/views/head.ejs b/public/views/head.ejs
index f1cdff15..fb51b14f 100644
--- a/public/views/head.ejs
+++ b/public/views/head.ejs
@@ -4,7 +4,7 @@
 <meta name="apple-mobile-web-app-capable" content="yes">
 <meta name="apple-mobile-web-app-status-bar-style" content="black">
 <meta name="mobile-web-app-capable" content="yes">
-<title><%- title %></title>
+<title><%= title %></title>
 <link rel="icon" type="image/png" href="<%- url %>/favicon.png">
 <link rel="apple-touch-icon" href="<%- url %>/apple-touch-icon.png">
 <% if(useCDN) { %>
diff --git a/public/views/pretty.ejs b/public/views/pretty.ejs
index 502aae40..f810a5a9 100644
--- a/public/views/pretty.ejs
+++ b/public/views/pretty.ejs
@@ -9,12 +9,12 @@
     <meta name="apple-mobile-web-app-status-bar-style" content="black">
     <meta name="mobile-web-app-capable" content="yes">
     <% if(typeof robots !== 'undefined' && robots) { %>
-    <meta name="robots" content="<%- robots %>">
+    <meta name="robots" content="<%= robots %>">
     <% } %>
     <% if(typeof description !== 'undefined' && description) { %>
-    <meta name="description" content="<%- description %>">
+    <meta name="description" content="<%= description %>">
     <% } %>
-    <title><%- title %></title>
+    <title><%= title %></title>
     <link rel="icon" type="image/png" href="<%- url %>/favicon.png">
 	<link rel="apple-touch-icon" href="<%- url %>/apple-touch-icon.png">
 	<% if(useCDN) { %>
@@ -59,7 +59,7 @@
             <% } %>
         </small>
     </div>
-    <div id="doc" class="container markdown-body"><%- body %></div>
+    <div id="doc" class="container markdown-body"><%= body %></div>
     <div class="ui-toc dropup unselectable hidden-print" style="display:none;">
         <div class="pull-right dropdown">
             <a id="tocLabel" class="ui-toc-label btn btn-default" data-toggle="dropdown" href="#" role="button" aria-haspopup="true" aria-expanded="false" title="Table of content">
diff --git a/public/views/slide.ejs b/public/views/slide.ejs
index df23988d..cd3be9aa 100644
--- a/public/views/slide.ejs
+++ b/public/views/slide.ejs
@@ -6,12 +6,12 @@
         <meta name="apple-mobile-web-app-status-bar-style" content="black">
         <meta name="mobile-web-app-capable" content="yes">
         <% if(typeof robots !== 'undefined' && robots) { %>
-        <meta name="robots" content="<%- robots %>">
+        <meta name="robots" content="<%= robots %>">
         <% } %>
         <% if(typeof description !== 'undefined' && description) { %>
-        <meta name="description" content="<%- description %>">
+        <meta name="description" content="<%= description %>">
         <% } %>
-        <title><%- title %></title>
+        <title><%= title %></title>
         <link rel="icon" type="image/png" href="<%- url %>/favicon.png">
         <link rel="apple-touch-icon" href="<%- url %>/apple-touch-icon.png">
         <% if(useCDN) { %>
@@ -55,10 +55,10 @@
     <body>
         <div class="container">
             <div class="reveal">
-                <div class="slides" style="display: none;"><%- body %></div>
+                <div class="slides" style="display: none;"><%= body %></div>
             </div>
 
-            <div id="meta" style="display: none;"><%- meta %></div>
+            <div id="meta" style="display: none;"><%= meta %></div>
 
             <div class="footer">
                 <div class="unselectable hidden-print" style="color: #777;">