Skip to content
Permalink
Browse files Browse the repository at this point in the history
Avoid self-XSS (#73)
  • Loading branch information
fregante authored and sindresorhus committed Mar 19, 2019
1 parent aa931c7 commit 9de0c57
Show file tree
Hide file tree
Showing 2 changed files with 20 additions and 3 deletions.
17 changes: 17 additions & 0 deletions extension/api.js
Expand Up @@ -36,3 +36,20 @@ HideFilesOnGitHub.storage = {
chrome.storage.sync.set(object);
}
};

// Inlined partial `escape-goat` package
const escapeHTML = input => input
.replace(/&/g, '&')
.replace(/"/g, '"')
.replace(/'/g, ''')
.replace(/</g, '&lt;')
.replace(/>/g, '&gt;');

window.escapeTag = (input, ...parts) => {
let output = input[0];
for (let i = 0; i < parts.length; i++) {
output = output + escapeHTML(parts[i]) + input[i + 1];
}

return output;
};
6 changes: 3 additions & 3 deletions extension/options.js
@@ -1,4 +1,4 @@
/* global HideFilesOnGitHub */
/* global HideFilesOnGitHub, escapeTag */
'use strict';
const regexField = document.querySelector('#hideRegExp');
const errorMessage = document.querySelector('#errorMessage');
Expand All @@ -11,14 +11,14 @@ document.addEventListener('change', update);
/* Native validation tooltips don't seem to work */
function setValidity(text = '') {
errorMessage.innerHTML = text;
regexField.setCustomValidity(text); /* Triggers :invalid */
regexField.setCustomValidity(errorMessage.textContent); /* Triggers :invalid */
}

function update() {
for (const line of regexField.value.split('\n')) {
// Don't allow delimiters in RegExp string
if (delimiters.test(line)) {
return setValidity(`Use <code>${line.replace(/^\/|\/$/g, '')}</code> instead of <code>${line}</code>. Slashes are not required.`);
return setValidity(escapeTag`Use <code>${line.replace(/^\/|\/$/g, '')}</code> instead of <code>${line}</code>. Slashes are not required.`);
}

// Fully test each RegExp
Expand Down

0 comments on commit 9de0c57

Please sign in to comment.