mirror of https://github.com/status-im/codimd.git
Fix slide might trigger script when processing markdown which cause XSS [Security Issue]
This commit is contained in:
parent
9383df59c9
commit
f86a9e0c4b
|
@ -16,15 +16,6 @@ var config = require("./config.js");
|
|||
var logger = require("./logger.js");
|
||||
var models = require("./models");
|
||||
|
||||
//slides
|
||||
var md = require('reveal.js/plugin/markdown/markdown');
|
||||
|
||||
//reveal.js
|
||||
var slideOptions = {
|
||||
separator: '^(\r\n?|\n)---(\r\n?|\n)$',
|
||||
verticalSeparator: '^(\r\n?|\n)----(\r\n?|\n)$'
|
||||
};
|
||||
|
||||
//public
|
||||
var response = {
|
||||
errorForbidden: function (res) {
|
||||
|
@ -584,7 +575,6 @@ function showPublishSlide(req, res, next) {
|
|||
var text = S(body).escapeHTML().s;
|
||||
var title = models.Note.decodeTitle(note.title);
|
||||
title = models.Note.generateWebTitle(meta.title || title);
|
||||
var slides = md.slidify(text, slideOptions);
|
||||
var origin = config.serverurl;
|
||||
var data = {
|
||||
title: title,
|
||||
|
@ -593,7 +583,7 @@ function showPublishSlide(req, res, next) {
|
|||
createtime: createtime,
|
||||
updatetime: updatetime,
|
||||
url: origin,
|
||||
slides: slides,
|
||||
body: text,
|
||||
meta: JSON.stringify(obj.meta || {}),
|
||||
useCDN: config.usecdn,
|
||||
owner: note.owner ? note.owner.id : null,
|
||||
|
|
|
@ -12,8 +12,7 @@ var finishView = extraModule.finishView;
|
|||
|
||||
var preventXSS = require('./render').preventXSS;
|
||||
|
||||
var body = $(".slides").html();
|
||||
$(".slides").html(S(body).unescapeHTML().s);
|
||||
var body = $(".slides").text();
|
||||
|
||||
createtime = lastchangeui.time.attr('data-createtime');
|
||||
lastchangetime = lastchangeui.time.attr('data-updatetime');
|
||||
|
@ -47,8 +46,15 @@ var deps = [{
|
|||
}
|
||||
}, {
|
||||
src: serverurl + '/js/reveal-markdown.js',
|
||||
condition: function() {
|
||||
return !!document.querySelector('[data-markdown]');
|
||||
callback: function () {
|
||||
var slideOptions = {
|
||||
separator: '^(\r\n?|\n)---(\r\n?|\n)$',
|
||||
verticalSeparator: '^(\r\n?|\n)----(\r\n?|\n)$'
|
||||
};
|
||||
var slides = RevealMarkdown.slidify(body, slideOptions);
|
||||
$(".slides").html(slides);
|
||||
RevealMarkdown.initialize();
|
||||
$(".slides").show();
|
||||
}
|
||||
}, {
|
||||
src: serverurl + '/vendor/reveal.js/plugin/notes/notes.js',
|
||||
|
|
|
@ -55,7 +55,7 @@
|
|||
<body>
|
||||
<div class="container">
|
||||
<div class="reveal">
|
||||
<div class="slides"><%- slides %></div>
|
||||
<div class="slides" style="display: none;"><%- body %></div>
|
||||
</div>
|
||||
|
||||
<div id="meta" style="display: none;"><%- meta %></div>
|
||||
|
|
Loading…
Reference in New Issue