From 659c0f75bec8537deabbaf912d4fb4cdbfc7c970 Mon Sep 17 00:00:00 2001 From: undefined Date: Wed, 27 Mar 2024 05:53:58 +0800 Subject: [PATCH] ui: fix xss --- packages/ui-default/backendlib/markdown-it-xss.ts | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/packages/ui-default/backendlib/markdown-it-xss.ts b/packages/ui-default/backendlib/markdown-it-xss.ts index 7602cfcf4..7fc6ab65b 100644 --- a/packages/ui-default/backendlib/markdown-it-xss.ts +++ b/packages/ui-default/backendlib/markdown-it-xss.ts @@ -111,11 +111,9 @@ export const xss = new FilterXSS({ }, allowCommentTag: false, stripIgnoreTagBody: ['script'], - safeAttrValue(tag, name, value) { + safeAttrValue(tag, name, value) { // eslint-disable-line consistent-return if (name === 'id') return `xss-id-${value}`; if (name === 'class') return value.replace(/badge/g, 'xss-badge'); - if (name === 'href') return value.trim().startsWith('javascript:') ? '#' : value; - return value; }, }); @@ -168,11 +166,9 @@ export const xssInline = new FilterXSS({ allowCommentTag: false, stripIgnoreTag: true, stripIgnoreTagBody: ['script'], - safeAttrValue(tag, name, value) { + safeAttrValue(tag, name, value) { // eslint-disable-line consistent-return if (name === 'id') return `xss-id-${value}`; if (name === 'class') return value.replace(/badge/g, 'xss-badge'); - if (name === 'href') return value.trim().startsWith('javascript:') ? '#' : value; - return value; }, });