diff options
| author | Wu Cheng-Han | 2016-11-26 22:46:08 +0800 |
|---|---|---|
| committer | Wu Cheng-Han | 2016-11-26 22:46:08 +0800 |
| commit | f86a9e0c4bbf852d2648430d5f7f3d837c40bd47 (patch) | |
| tree | 1343b849e649c5d6490acec801266db7a4652cf2 | |
| parent | 9383df59c97e3c5d698411faf0e02d39d0aedec5 (diff) | |
Fix slide might trigger script when processing markdown which cause XSS [Security Issue]
| -rwxr-xr-x | lib/response.js | 12 | ||||
| -rw-r--r-- | public/js/slide.js | 14 | ||||
| -rw-r--r-- | public/views/slide.ejs | 2 |
3 files changed, 12 insertions, 16 deletions
diff --git a/lib/response.js b/lib/response.js index fa97f157..1a45d63a 100755 --- a/lib/response.js +++ b/lib/response.js @@ -16,15 +16,6 @@ var config = require("./config.js"); var logger = require("./logger.js"); var models = require("./models"); -//slides -var md = require('reveal.js/plugin/markdown/markdown'); - -//reveal.js -var slideOptions = { - separator: '^(\r\n?|\n)---(\r\n?|\n)$', - verticalSeparator: '^(\r\n?|\n)----(\r\n?|\n)$' -}; - //public var response = { errorForbidden: function (res) { @@ -584,7 +575,6 @@ function showPublishSlide(req, res, next) { var text = S(body).escapeHTML().s; var title = models.Note.decodeTitle(note.title); title = models.Note.generateWebTitle(meta.title || title); - var slides = md.slidify(text, slideOptions); var origin = config.serverurl; var data = { title: title, @@ -593,7 +583,7 @@ function showPublishSlide(req, res, next) { createtime: createtime, updatetime: updatetime, url: origin, - slides: slides, + body: text, meta: JSON.stringify(obj.meta || {}), useCDN: config.usecdn, owner: note.owner ? note.owner.id : null, diff --git a/public/js/slide.js b/public/js/slide.js index b9521e64..a8411570 100644 --- a/public/js/slide.js +++ b/public/js/slide.js @@ -12,8 +12,7 @@ var finishView = extraModule.finishView; var preventXSS = require('./render').preventXSS; -var body = $(".slides").html(); -$(".slides").html(S(body).unescapeHTML().s); +var body = $(".slides").text(); createtime = lastchangeui.time.attr('data-createtime'); lastchangetime = lastchangeui.time.attr('data-updatetime'); @@ -47,8 +46,15 @@ var deps = [{ } }, { src: serverurl + '/js/reveal-markdown.js', - condition: function() { - return !!document.querySelector('[data-markdown]'); + callback: function () { + var slideOptions = { + separator: '^(\r\n?|\n)---(\r\n?|\n)$', + verticalSeparator: '^(\r\n?|\n)----(\r\n?|\n)$' + }; + var slides = RevealMarkdown.slidify(body, slideOptions); + $(".slides").html(slides); + RevealMarkdown.initialize(); + $(".slides").show(); } }, { src: serverurl + '/vendor/reveal.js/plugin/notes/notes.js', diff --git a/public/views/slide.ejs b/public/views/slide.ejs index 437f0c97..df23988d 100644 --- a/public/views/slide.ejs +++ b/public/views/slide.ejs @@ -55,7 +55,7 @@ <body> <div class="container"> <div class="reveal"> - <div class="slides"><%- slides %></div> + <div class="slides" style="display: none;"><%- body %></div> </div> <div id="meta" style="display: none;"><%- meta %></div> |