Weishen/Hydro
2
0 Fork 0
mirror of https://gitcode.com/gh_mirrors/hy/Hydro.git synced 2026-10-20 01:38:19 +08:00
Code Issues Packages Projects Releases Wiki Activity

ui: fix xss (#775)

Browse Source
This commit is contained in:
Yang Gao authored and GitHub committed 2024-04-01 23:42:09 +08:00
1 parent 36c6faf736
commit 09ac293e22
1 file changed
+5 -5
Download Patch File Download Diff File Expand all files Collapse all files
packages/ui-default/backendlib/markdown-it-xss.ts
+5 -5
View File
@@ -1,4 +1,4 @@
import { FilterXSS, safeAttrValue } from 'xss'; import { escapeAttrValue, FilterXSS, safeAttrValue } from 'xss';
const stack = []; const stack = [];
const voidTags = ['br', 'hr', 'input', 'img', 'link', 'source', 'col', 'area', 'base', 'meta', 'embed', 'param', 'track', 'wbr']; const voidTags = ['br', 'hr', 'input', 'img', 'link', 'source', 'col', 'area', 'base', 'meta', 'embed', 'param', 'track', 'wbr'];
@@ -112,8 +112,8 @@ export const xss = new FilterXSS({
allowCommentTag: false, allowCommentTag: false,
stripIgnoreTagBody: ['script'], stripIgnoreTagBody: ['script'],
safeAttrValue(tag, name, value) { safeAttrValue(tag, name, value) {
if (name === 'id') return `xss-id-${value}`; if (name === 'id') return escapeAttrValue(`xss-id-${value}`);
if (name === 'class') return value.replace(/badge/g, 'xss-badge'); if (name === 'class') return escapeAttrValue(value.replace(/badge/g, 'xss-badge'));
return safeAttrValue(tag, name, value, this.cssFilter); return safeAttrValue(tag, name, value, this.cssFilter);
}, },
}); });
@@ -168,8 +168,8 @@ export const xssInline = new FilterXSS({
stripIgnoreTag: true, stripIgnoreTag: true,
stripIgnoreTagBody: ['script'], stripIgnoreTagBody: ['script'],
safeAttrValue(tag, name, value) { safeAttrValue(tag, name, value) {
if (name === 'id') return `xss-id-${value}`; if (name === 'id') return escapeAttrValue(`xss-id-${value}`);
if (name === 'class') return value.replace(/badge/g, 'xss-badge'); if (name === 'class') return escapeAttrValue(value.replace(/badge/g, 'xss-badge'));
return safeAttrValue(tag, name, value, this.cssFilter); return safeAttrValue(tag, name, value, this.cssFilter);
}, },
}); });