From 09ac293e2247660ce2c3c632635d389243f8087d Mon Sep 17 00:00:00 2001
From: Yang Gao <6821729+criyle@users.noreply.github.com>
Date: Mon, 1 Apr 2024 23:42:09 +0800
Subject: [PATCH] ui: fix xss (#775)

---
 packages/ui-default/backendlib/markdown-it-xss.ts | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/packages/ui-default/backendlib/markdown-it-xss.ts b/packages/ui-default/backendlib/markdown-it-xss.ts
index 9bd04d40f..273cf2905 100644
--- a/packages/ui-default/backendlib/markdown-it-xss.ts
+++ b/packages/ui-default/backendlib/markdown-it-xss.ts
@@ -1,4 +1,4 @@
-import { FilterXSS, safeAttrValue } from 'xss';
+import { escapeAttrValue, FilterXSS, safeAttrValue } from 'xss';
 
 const stack = [];
 const voidTags = ['br', 'hr', 'input', 'img', 'link', 'source', 'col', 'area', 'base', 'meta', 'embed', 'param', 'track', 'wbr'];
@@ -112,8 +112,8 @@ export const xss = new FilterXSS({
   allowCommentTag: false,
   stripIgnoreTagBody: ['script'],
   safeAttrValue(tag, name, value) {
-    if (name === 'id') return `xss-id-${value}`;
-    if (name === 'class') return value.replace(/badge/g, 'xss-badge');
+    if (name === 'id') return escapeAttrValue(`xss-id-${value}`);
+    if (name === 'class') return escapeAttrValue(value.replace(/badge/g, 'xss-badge'));
     return safeAttrValue(tag, name, value, this.cssFilter);
   },
 });
@@ -168,8 +168,8 @@ export const xssInline = new FilterXSS({
   stripIgnoreTag: true,
   stripIgnoreTagBody: ['script'],
   safeAttrValue(tag, name, value) {
-    if (name === 'id') return `xss-id-${value}`;
-    if (name === 'class') return value.replace(/badge/g, 'xss-badge');
+    if (name === 'id') return escapeAttrValue(`xss-id-${value}`);
+    if (name === 'class') return escapeAttrValue(value.replace(/badge/g, 'xss-badge'));
     return safeAttrValue(tag, name, value, this.cssFilter);
   },
 });