diff options
| -rw-r--r-- | public/js/render.js | 1 | ||||
| -rwxr-xr-x[-rw-r--r--] | public/js/reveal-markdown.js | 5 |
2 files changed, 5 insertions, 1 deletions
diff --git a/public/js/render.js b/public/js/render.js index 559530b0..a61fc8fb 100644 --- a/public/js/render.js +++ b/public/js/render.js @@ -1,5 +1,6 @@ // allow some attributes var whiteListAttr = ['id', 'class', 'style']; +window.whiteListAttr = whiteListAttr; // allow link starts with '.', '/' and custom protocol with '://' var linkRegex = /^([\w|-]+:\/\/)|^([\.|\/])+/; // allow data uri, from https://gist.github.com/bgrins/6194623 diff --git a/public/js/reveal-markdown.js b/public/js/reveal-markdown.js index ca22e09c..3c3e1f5b 100644..100755 --- a/public/js/reveal-markdown.js +++ b/public/js/reveal-markdown.js @@ -286,7 +286,10 @@ nodeValue = nodeValue.substring( 0, matches.index ) + nodeValue.substring( mardownClassesInElementsRegex.lastIndex ); node.nodeValue = nodeValue; while( matchesClass = mardownClassRegex.exec( classes ) ) { - elementTarget.setAttribute( matchesClass[1], matchesClass[2] ); + var name = matchesClass[1]; + var value = matchesClass[2]; + if (name.substr(0, 5) === 'data-' || whiteListAttr.indexOf(name) !== -1) + elementTarget.setAttribute( name, filterXSS.escapeAttrValue(value) ); } return true; } |