Skip to content
Permalink
Browse files Browse the repository at this point in the history
Secure Text Selection addon against xss attacks, re #8593 (#881)
* sanitize Wiris response against XSS in the Wiris addon

* added tests

* Secure Text Selection addon against xss attacks

Co-authored-by: Maciej Zawłocki <mzawlocki@solwit.com>
Co-authored-by: maciej-zawlocki-solwit <34648176+maciej-zawlocki-solwit@users.noreply.github.com>
Co-authored-by: Michal-sw-solwit <100777673+Michal-sw-solwit@users.noreply.github.com>
  • Loading branch information
4 people committed Dec 20, 2022
1 parent 5f67d66 commit 2223628
Show file tree
Hide file tree
Showing 2 changed files with 11 additions and 7 deletions.
17 changes: 10 additions & 7 deletions addons/Text_Selection/src/presenter.js
Expand Up @@ -1558,8 +1558,10 @@ function AddonText_Selection_create() {
};

presenter.getWordsTextVoices = function($element) {
var $clone = $element.clone();
$clone.find('.selectable').each(function(){
var sanitizedHTML = window.xssUtils.sanitize($element[0].outerHTML);
var $sanitizedElement = $(sanitizedHTML);

$($sanitizedElement).find('.selectable').each(function(){
var $this = $(this);

if ($this.hasClass('selected')) {
Expand All @@ -1574,7 +1576,7 @@ function AddonText_Selection_create() {
}
});

var textArray = presenter.getTextFromElementWithAltTexts($clone).split(SPLIT);
var textArray = presenter.getTextFromElementWithAltTexts($sanitizedElement).split(SPLIT);

var textVoices = [];

Expand All @@ -1595,10 +1597,12 @@ function AddonText_Selection_create() {
};

presenter.getPhrasesTextVoices = function($element) {
var $clone = $element.clone();
var sanitizedHTML = window.xssUtils.sanitize($element[0].outerHTML);
var $sanitizedElement = $(sanitizedHTML);

$clone.find('.selectable').each(function(index){
$sanitizedElement.find('.selectable').each(function(index){
var $this = $(this);

$this.html(SPLIT + PHRASE + ' ' + (index+1) + SPLIT + $this.html() + SPLIT + PHRASE_END + SPLIT );

if ($this.hasClass('selected')) {
Expand All @@ -1613,7 +1617,7 @@ function AddonText_Selection_create() {
}
});

var textArray = presenter.getTextFromElementWithAltTexts($clone).split(SPLIT);
var textArray = presenter.getTextFromElementWithAltTexts($sanitizedElement).split(SPLIT);

var textVoices = [];

Expand Down Expand Up @@ -1647,7 +1651,6 @@ function AddonText_Selection_create() {
}

presenter.getSectionsTextVoices = function($element) {

var $clone = $element.clone();

$clone.find('.selectable').each(function(){
Expand Down
1 change: 1 addition & 0 deletions changelog.txt
Expand Up @@ -9,6 +9,7 @@
2022-11-25 Removed pause while reading syntax about time for TTS
2022-11-25 Fixed TTS reading an extra comma when alt text with dot is present at the end of a list element
2022-11-25 Fixed no break in tts at the end of a line of text.
2022-11-22 Secured Text Selection addon against xss attacks
2022-11-14 Fixed support for only one audio type in slideshow addon
2022-11-10 Added grid size and rulers position separation
2022-11-07 Added worksWithAll property to eKeyboard
Expand Down

0 comments on commit 2223628

Please sign in to comment.