From 0f03f0e70e1a2339e0f965594de0763a95b21284 Mon Sep 17 00:00:00 2001
From: undefined <i@undefined.moe>
Date: Fri, 20 Jan 2023 14:53:27 +0800
Subject: [PATCH] ui: add limitation for href

---
 packages/ui-default/backendlib/markdown-it-xss.ts | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/packages/ui-default/backendlib/markdown-it-xss.ts b/packages/ui-default/backendlib/markdown-it-xss.ts
index 0153ec6d6..23d0a218e 100644
--- a/packages/ui-default/backendlib/markdown-it-xss.ts
+++ b/packages/ui-default/backendlib/markdown-it-xss.ts
@@ -1,9 +1,9 @@
-import * as Xss from 'xss';
+import { FilterXSS } from 'xss';
 
 const stack = [];
 const voidTags = ['br', 'hr', 'input', 'img', 'link', 'source', 'col', 'area', 'base', 'meta', 'embed', 'param', 'track', 'wbr'];
 
-const tagCheck = new Xss.FilterXSS({
+const tagCheck = new FilterXSS({
   css: false,
   whiteList: {},
   onIgnoreTag(tag, html, options) {
@@ -32,7 +32,7 @@ const tagCheck = new Xss.FilterXSS({
   },
 });
 
-export const xss = new Xss.FilterXSS({
+export const xss = new FilterXSS({
   whiteList: {
     a: ['target', 'href', 'title'],
     abbr: ['title'],
@@ -113,6 +113,7 @@ export const xss = new Xss.FilterXSS({
   safeAttrValue(tag, name, value) {
     if (name === 'id') return `xss-id-${value}`;
     if (name === 'class') return value.replace(/badge/g, 'xss-badge');
+    if (name === 'href') return value.trim().startsWith('javascript:') ? '#' : value;
     return value;
   },
 });