Skip to content

Commit 4f8750b

Browse files
committed
Potentiel security bug corrected
Bug reproduction: 1) paste texte containing html/javascript. 2) send 3) clic "Raw text" 4) refresh: The html/javascript is interpreted instead of just displayed. Under some versions of Chrome, it happens without refreshing. This bug was corrected.
1 parent 43fa904 commit 4f8750b

File tree

1 file changed

+3
-4
lines changed

1 file changed

+3
-4
lines changed

js/zerobin.js

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -453,10 +453,9 @@ function stateExistingPaste() {
453453
*/
454454
function rawText()
455455
{
456-
history.pushState(document.title, document.title, 'document.txt');
457-
var paste = $('div#cleartext').text();
458-
var newDoc = document.open('text/plain', 'replace');
459-
newDoc.write(paste);
456+
var paste = $('div#cleartext').html();
457+
var newDoc = document.open('text/html', 'replace');
458+
newDoc.write('<pre>'+paste+'</pre>');
460459
newDoc.close();
461460
}
462461

0 commit comments

Comments
 (0)