fix for xss

MyEtherWallet · Mar 13, 2018 · 093af73 · 093af73
1 parent 84770c2
commit 093af73
Show file tree

Hide file tree

Showing 7 changed files with 2,245 additions and 27 deletions.
diff --git a/app/scripts/controllers/tabsCtrl.js b/app/scripts/controllers/tabsCtrl.js
@@ -99,7 +99,7 @@ var tabsCtrl = function($scope, globalService, $translate, $sce) {
                 $scope.notifier.danger(globalFuncs.errorMsgs[32]);
             } else {
                 $scope.nodeIsConnected = true;
-                $scope.notifier.info( globalFuncs.successMsgs[5] + '<br /> URL: <strong>' + window.location.href + '</strong> <br /> Network: <strong>' + $scope.nodeType + ' </strong> provided by <strong>' + $scope.nodeService + '</strong>', 10000)
+                $scope.notifier.info( globalFuncs.successMsgs[5] + '<br /> URL: <strong>' + globalFuncs.stripTags(window.location.href) + '</strong> <br /> Network: <strong>' + $scope.nodeType + ' </strong> provided by <strong>' + $scope.nodeService + '</strong>', 10000)
             }
         });
         networkHasChanged && window.setTimeout(function() {

diff --git a/app/scripts/globalFuncs.js b/app/scripts/globalFuncs.js
@@ -163,11 +163,7 @@ globalFuncs.urlGet = function(name) {
     if (name = (new RegExp('[?&]' + encodeURIComponent(name) + '=([^&]*)')).exec(location.search.toLowerCase())) return this.stripTags(decodeURIComponent(name[1]));
 };
 globalFuncs.stripTags = function(str) {
-    var SCRIPT_REGEX = /<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi;
-    while (SCRIPT_REGEX.test(str)) {
-        str = str.replace(SCRIPT_REGEX, "");
-    }
-    return str;
+    return xssFilters.inHTMLData(str);
 };
 globalFuncs.checkAndRedirectHTTPS = function() {
     var host = "myetherwallet.com";

diff --git a/app/scripts/main.js b/app/scripts/main.js
@@ -10,6 +10,8 @@ var angularSanitize          = require('angular-sanitize');
 var angularAnimate           = require('angular-animate');
 var bip39                    = require('bip39');
 var HDKey                    = require('hdkey');
+var xssFilters               = require('xss-filters');
+window.xssFilters            = xssFilters;
 window.hd                    = { bip39: bip39, HDKey: HDKey };
 var BigNumber                = require('bignumber.js');
 window.BigNumber             = BigNumber;

diff --git a/chrome-extension/js/etherwallet-master.js b/chrome-extension/js/etherwallet-master.js
diff --git a/dist/js/etherwallet-master.js b/dist/js/etherwallet-master.js
diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -65,6 +65,7 @@
     "npm": "^4.5.0",
     "run-sequence": "^1.2.2",
     "vinyl-buffer": "^1.0.0",
-    "vinyl-source-stream": "^1.1.0"
+    "vinyl-source-stream": "^1.1.0",
+    "xss-filters": "^1.2.7"
   }
 }