Skip to content

Commit

Permalink
Browse files Browse the repository at this point in the history
JS fix stored XSS issue
  • Loading branch information
francoisjacquet committed Apr 25, 2022
1 parent 44b6343 commit 7ded1e2
Show file tree
Hide file tree
Showing 4 changed files with 11 additions and 6 deletions.
1 change: 1 addition & 0 deletions CHANGES.md
Expand Up @@ -56,6 +56,7 @@ Changes in 9.0
- Fix SQL injection escape DB identifier in RegistrationSave.fnc.php, Calendar.php, MarkingPeriods.php, Courses.php, SchoolFields.php, AddressFields.php, PeopleFields.php, StudentFields.php & UserFields.php
- JS update marked to v4.0.14 in assets/js/marked/
- JS add DOMPurify 2.3.6 in assets/js/DOMPurify/ & Gruntfile.js
- JS fix stored XSS issue related to MarkDown in warehouse.js & plugins.min.js, thanks to @intrapus

Changes in 8.9.5
----------------
Expand Down
4 changes: 2 additions & 2 deletions assets/js/plugins.min.js

Large diffs are not rendered by default.

2 changes: 1 addition & 1 deletion assets/js/plugins.min.js.map

Large diffs are not rendered by default.

10 changes: 7 additions & 3 deletions assets/js/warehouse.js
Expand Up @@ -138,12 +138,16 @@ var GetMDConverter = function() {

// Set options.
// @link https://marked.js.org/#/USING_ADVANCED.md
return marked(markDown, {
marked.setOptions({
breaks: true, // Add <br> on a single line break. Requires gfm be true.
gfm: true, // GitHub Flavored Markdown (GFM).
headerIds: false, // Include an id attribute when emitting headings (h1, h2, h3, etc).
renderer: renderer,
});

var md = marked.parse(markDown);

return DOMPurify.sanitize(md);
};
}

Expand Down Expand Up @@ -180,8 +184,8 @@ var MarkDownToHTML = function() {

var mdc = GetMDConverter();

// Fix decode &, < and > HTML characters so blockquote are converted.
var md = mdc( txt.replace(/&amp;/g, '&').replace(/&lt;/g, '<').replace(/&gt;/g, '>') );
// Fix decode > HTML characters so blockquote are converted.
var md = mdc( txt.replace(/&gt;/g, '>') );

// Add paragraph to text.
var txtP = '<p>' + txt + '</p>';
Expand Down

0 comments on commit 7ded1e2

Please sign in to comment.