github/marktext
5
0
Fork 0
mirror of https://github.com/marktext/marktext.git synced 2025-05-16 17:00:30 +08:00
Code Issues Packages Projects Releases Wiki Activity

Fix: #1390 prevent XSS attack

Browse Source
This commit is contained in:
Ran Luo 2019-09-28 21:09:06 +08:00 committed by Felix Häusler
parent dee8bb6f5b
commit 0baf2e9e85
2 changed files with 9 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/muya/lib/parser/render/renderInlines/htmlTag.js
View File

@ -1,6 +1,9 @@
import createDOMPurify from 'dompurify'
import { CLASS_OR_ID, BLOCK_TYPE6 } from '../../../config'
import { snakeToCamel } from '../../../utils'
const { sanitize } = createDOMPurify(window)
export default function htmlTag (h, cursor, block, token, outerClass) {
const { tag, openTag, closeTag, children, attrs } = token
const className = children ? this.getClassName(outerClass, block, token, cursor) : CLASS_OR_ID['AG_GRAY']
@ -34,8 +37,9 @@ export default function htmlTag (h, cursor, block, token, outerClass) {
// if tag is a block level element, use a inline element `span` to instead.
// Because we can not nest a block level element in span element(line is span element)
// we also recommand user not use block level element in paragraph. use block element in html block.
let selector = BLOCK_TYPE6.includes(tag) ? 'span' : tag
selector += `.${CLASS_OR_ID['AG_INLINE_RULE']}`
// Use code !sanitize(`<${tag}>`) to filter some malicious tags. for example: <embed>.
let selector = BLOCK_TYPE6.includes(tag) || !sanitize(`<${tag}>`) ? 'span' : tag
selector += `.${CLASS_OR_ID.AG_INLINE_RULE}`
const data = {
attrs: {},
dataset: {}

4
src/muya/lib/parser/utils.js
View File

@ -7,7 +7,9 @@ export const PUNCTUATION_REG = new RegExp(/[!"#$%&'()*+,\-./:;<=>?@\[\]^_`{|}~\x
export const WHITELIST_ATTRIBUTES = [
'align', 'alt', 'checked', 'class', 'color', 'dir', 'disabled', 'for', 'height', 'hidden',
'href', 'id', 'lang', 'lazyload', 'rel', 'spellcheck', 'src', 'srcset', 'start', 'style',
'target', 'title', 'type', 'value', 'width'
'target', 'title', 'type', 'value', 'width',
// Used in img
'data-align'
]
// export const unicodeZsCategory = [