Applies DOMSanitize.sanitize to innerHTML write #8388
Conversation
|
just accepted CLA |
LukeWood
force-pushed
the
commandfix
branch
2 times, most recently
from
6794ab6
to
de798d9
Compare
akosyakov
added
security
These eslint rules attempt to surface XSS sinks from eslint. This commit is a first pass on eclipse-theia#8398 Change-Id: I142bbba9785c4567dfbea1380f5a980560cf7413 Signed-off-by: LukeWood <lukewoodcs@gmail.com>
|
Any update on this one? |
There was a problem hiding this comment.
@LukeWood can you include the dompurify dependency as part of @theia/plugin-ext (at the moment it is only provided by @theia/preview)? This will ensure that if a downstream app includes @theia/plugin-ext and not @theia/preview it will still work correctly.
|
@LukeWood would you like me to take care of the outstanding issue #8388 (review) so it can be merged? |
|
apologies - I didn't realize there were still outstanding issues. If you could do that it would be great - I though I pushed a local copy but I must be mistaken |
vince-fugnitto
force-pushed
the
commandfix
branch
from
de798d9
to
53e363d
Compare
This commit sanitizes the text applied to innerHTML of the linkNode attribute on OpenUriCommandHandler. This is an attempt to limit the xss sink surface in Theia. If there is no reason to do so or this breaks some intended behavior please leave a comment indicating so. Change-Id: Ibee9829b3a44f87d15c9d46b9bc342332e5ccf08 Signed-off-by: Luke Wood <lukewoodcs@gmail.com>
vince-fugnitto
force-pushed
the
commandfix
branch
from
53e363d
to
9cf33e3
Compare
No problem! I updated the pull-request to include the necessary dependencies in the |
This commit sanitizes the text applied to innerHTML of the linkNode
attribute on OpenUriCommandHandler. This is an attempt to limit the
xss sink surface in Theia.
If there is no reason to do so or this breaks some intended behavior
please leave a comment indicating so.
Signed-off-by: Luke Wood lukewood@google.com
Change-Id: Ibee9829b3a44f87d15c9d46b9bc342332e5ccf08
What it does
sanitizes text assigned to innerHTML in an anchor element
How to test
This is not to address a specific bug - just a precaution.