status-im
/
status-desktop
mirror of https://github.com/status-im/status-desktop.git
2
0
Fork 0
Code Issues Projects Releases Wiki Activity

fix: protect against XSS in chat names

This commit is contained in:
Jonathan Rainville 2020-11-05 15:03:53 -05:00 committed by Iuri Matias
parent cd8f49921f
commit dbc1d26966
2 changed files with 6 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
ui/app/AppLayouts/Chat/components/GroupChatPopup.qml
View File

@ -57,7 +57,7 @@ ModalPopup {
function doJoin(){
if(pubKeys.length === 0) return;
chatsModel.createGroup(groupName.text, JSON.stringify(pubKeys));
chatsModel.createGroup(Utils.filterXSS(groupName.text), JSON.stringify(pubKeys));
popup.close();
}

7
ui/imports/Utils.qml
View File

@ -54,8 +54,11 @@ QtObject {
var replacePattern2 = /(^|[^\/])(www\.[\S]+(\b|$))/gim;
replacedText = replacedText.replace(replacePattern2, "$1<a href='http://$2'>$2</a>");
replacedText = XSS.filterXSS(replacedText)
return replacedText;
return XSS.filterXSS(replacedText)
}
function filterXSS(inputText) {
return XSS.filterXSS(inputText)
}
function toLocaleString(val, locale, options) {