diff options
| author | Wu Cheng-Han | 2016-11-26 22:46:58 +0800 |
|---|---|---|
| committer | Wu Cheng-Han | 2016-11-26 22:46:58 +0800 |
| commit | 79d5b2c37f99bcfc8e86e8045557f0a0557f93c4 (patch) | |
| tree | 470870a8224e01660f5254841393a2297a49160e /public/js/render.js | |
| parent | f86a9e0c4bbf852d2648430d5f7f3d837c40bd47 (diff) | |
Fix slide might able to add unsafe attribute on section tag which cause XSS [Security Issue]
Diffstat (limited to 'public/js/render.js')
| -rw-r--r-- | public/js/render.js | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/public/js/render.js b/public/js/render.js index 559530b0..a61fc8fb 100644 --- a/public/js/render.js +++ b/public/js/render.js @@ -1,5 +1,6 @@ // allow some attributes var whiteListAttr = ['id', 'class', 'style']; +window.whiteListAttr = whiteListAttr; // allow link starts with '.', '/' and custom protocol with '://' var linkRegex = /^([\w|-]+:\/\/)|^([\.|\/])+/; // allow data uri, from https://gist.github.com/bgrins/6194623 |