amam/self_xss

src/common/rivetsExtra.es6

@@ -29,7 +29,7 @@ rv.formatters['i18n'] = (value) => {
    if (typeof value === 'string') return value.i18n();
    return value;
 };
-rv.formatters['sanitize'] = (value) => value.replace(/("|'|\&|\(|\)|\<|\>)/g, '');
+rv.formatters['sanitize'] = (value) => value.replace(/("|'|\&|\(|\)|\<|\>|\;)/g, '');
 /* rivets formatter to get the property value of an object */
 rv.formatters['prop'] = (value, prop) => {
    return value && value[prop];

src/oauth/login.es6

@@ -68,7 +68,7 @@ const init_state = (root, win) => {
          login();
       },
       onRegister: () => {
-         const register_link = getBinaryUrl('home');
+         const register_link = getBinaryUrl('home.html');
          window.open(register_link, '_blank');
       },
    };

src/workspace/workspace.es6

@@ -20,7 +20,7 @@ const INITIAL_WORKSPACE_NAME = 'my-workspace-1';
 
 const clone = obj => JSON.parse(JSON.stringify(obj));
 
-const sanitize = value => value.replace(/("|'|\&|\(|\)|\<|\>)/g, '');
+const sanitize = value => value.replace(/("|'|\&|\(|\)|\<|\>|\;)/g, '');
 
 const state = {
    route: 'active', // one of ['active', 'saved', 'rename', 'saveas']
@@ -213,7 +213,7 @@ const state = {
          const {name} = w;
          const inx = _.findIndex(state.workspaces, {name: name});
          const workspace = inx !== -1 ? state.workspaces[inx] : local_storage.get('states');
-         workspace.name = name;
+         workspace.name = sanitize(name);
          workspace.template_type = 'workspace-template';
          workspace.random = state.file.hash_code(workspace)
          var json = JSON.stringify(workspace);