diff options
| author | Christoph (Sheogorath) Kern | 2018-12-29 21:52:03 +0100 |
|---|---|---|
| committer | GitHub | 2018-12-29 21:52:03 +0100 |
| commit | dba9575c94743a4efd65ff3db0d8748161ca13f0 (patch) | |
| tree | b5aa48f2321cc793c3d389864c89a006401ef472 /public | |
| parent | f9cc2ff0ef56aa5f0a655f9209321460748ba621 (diff) | |
| parent | 067cfe2d1eedc5a58e5548785858e38fbaa0e84b (diff) | |
Merge pull request #1112 from hackmdio/fix-XSS-issues
Fix some XSS issues
Diffstat (limited to 'public')
| -rw-r--r-- | public/js/render.js | 2 | ||||
| -rw-r--r-- | public/views/shared/disqus.ejs | 2 |
2 files changed, 2 insertions, 2 deletions
diff --git a/public/js/render.js b/public/js/render.js index ff5e2bf2..87e5cfdf 100644 --- a/public/js/render.js +++ b/public/js/render.js @@ -45,7 +45,7 @@ var filterXSSOptions = { // allow comment tag if (tag === '!--') { // do not filter its attributes - return html + return html.replace(/<(?!!--)/g, '<').replace(/-->/g, '__HTML_COMMENT_END__').replace(/>/g, '>').replace(/__HTML_COMMENT_END__/g, '-->') } }, onTagAttr: function (tag, name, value, isWhiteAttr) { diff --git a/public/views/shared/disqus.ejs b/public/views/shared/disqus.ejs index 840d1e38..2311d3fe 100644 --- a/public/views/shared/disqus.ejs +++ b/public/views/shared/disqus.ejs @@ -5,7 +5,7 @@ var disqus_config = function () { }; (function() { var d = document, s = d.createElement('script'); - s.src = 'https://<%= disqus %>.disqus.com/embed.js'; + s.src = 'https://<%= disqus.replace(/[^A-Za-z0-9]+/g, '') %>.disqus.com/embed.js'; s.setAttribute('data-timestamp', +new Date()); (d.head || d.body).appendChild(s); })(); |