fix(dashboard): Prevent XSS attack vector (#21822)

Co-authored-by: Herbert Gainor <herbert.gainor@preset.io>
apache · Oct 19, 2022 · ec20c01 · ec20c01
1 parent 7c4102c
commit ec20c01
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/superset-frontend/packages/superset-ui-core/src/components/SafeMarkdown.tsx b/superset-frontend/packages/superset-ui-core/src/components/SafeMarkdown.tsx
@@ -30,7 +30,7 @@ interface SafeMarkdownProps {
 
 function isSafeMarkup(node: MarkdownAbstractSyntaxTree) {
   return node.type === 'html' && node.value
-    ? /href="(javascript|vbscript|file):.*"/gim.test(node.value) === false
+    ? !/(href|src)="(javascript|vbscript|file):.*"/gim.test(node.value)
     : true;
 }