From 9d4ede4cffae47b9fd81ffbd0f2edff47c29e224 Mon Sep 17 00:00:00 2001
From: Wu Cheng-Han
Date: Sat, 26 Nov 2016 22:55:31 +0800
Subject: Fix possible XSS in yaml-metadata and turn using ejs escape syntax
than external lib [Security Issue]
---
lib/response.js | 7 ++-----
public/js/pretty.js | 5 +----
public/js/slide.js | 3 ---
public/views/disqus.ejs | 2 +-
public/views/ga.ejs | 2 +-
public/views/head.ejs | 2 +-
public/views/pretty.ejs | 8 ++++----
public/views/slide.ejs | 10 +++++-----
8 files changed, 15 insertions(+), 24 deletions(-)
diff --git a/lib/response.js b/lib/response.js
index 1a45d63a..b2d13988 100755
--- a/lib/response.js
+++ b/lib/response.js
@@ -186,7 +186,6 @@ function showPublishNote(req, res, next) {
if (!meta) meta = {};
var createtime = note.createdAt;
var updatetime = note.lastchangeAt;
- var text = S(body).escapeHTML().s;
var title = models.Note.decodeTitle(note.title);
title = models.Note.generateWebTitle(meta.title || title);
var origin = config.serverurl;
@@ -197,7 +196,7 @@ function showPublishNote(req, res, next) {
createtime: createtime,
updatetime: updatetime,
url: origin,
- body: text,
+ body: body,
useCDN: config.usecdn,
owner: note.owner ? note.owner.id : null,
ownerprofile: note.owner ? models.User.parseProfile(note.owner.profile) : null,
@@ -258,7 +257,6 @@ function actionInfo(req, res, note) {
if (!meta) meta = {};
var createtime = note.createdAt;
var updatetime = note.lastchangeAt;
- var text = S(body).escapeHTML().s;
var title = models.Note.decodeTitle(note.title);
var data = {
title: meta.title || title,
@@ -572,7 +570,6 @@ function showPublishSlide(req, res, next) {
if (!meta) meta = {};
var createtime = note.createdAt;
var updatetime = note.lastchangeAt;
- var text = S(body).escapeHTML().s;
var title = models.Note.decodeTitle(note.title);
title = models.Note.generateWebTitle(meta.title || title);
var origin = config.serverurl;
@@ -583,7 +580,7 @@ function showPublishSlide(req, res, next) {
createtime: createtime,
updatetime: updatetime,
url: origin,
- body: text,
+ body: body,
meta: JSON.stringify(obj.meta || {}),
useCDN: config.usecdn,
owner: note.owner ? note.owner.id : null,
diff --git a/public/js/pretty.js b/public/js/pretty.js
index f43df90c..c1a471a1 100644
--- a/public/js/pretty.js
+++ b/public/js/pretty.js
@@ -4,9 +4,6 @@ require('../css/site.css');
require('highlight.js/styles/github-gist.css');
-/* other vendors plugin */
-var S = require('string');
-
var extra = require('./extra');
var md = extra.md;
var finishView = extra.finishView;
@@ -22,7 +19,7 @@ var scrollToHash = extra.scrollToHash;
var preventXSS = require('./render').preventXSS;
var markdown = $("#doc.markdown-body");
-var text = S(markdown.html()).unescapeHTML().s;
+var text = markdown.text();
var lastMeta = md.meta;
md.meta = {};
var rendered = md.render(text);
diff --git a/public/js/slide.js b/public/js/slide.js
index a8411570..8d45219e 100644
--- a/public/js/slide.js
+++ b/public/js/slide.js
@@ -2,9 +2,6 @@ require('../css/extra.css');
require('../css/site.css');
require('../css/slide.css');
-/* other vendors plugin */
-var S = require('string');
-
var extraModule = require('./extra');
var md = extraModule.md;
var updateLastChange = extraModule.updateLastChange;
diff --git a/public/views/disqus.ejs b/public/views/disqus.ejs
index ed991a41..cceaa85c 100644
--- a/public/views/disqus.ejs
+++ b/public/views/disqus.ejs
@@ -5,7 +5,7 @@ var disqus_config = function () {
};
(function() {
var d = document, s = d.createElement('script');
- s.src = '//<%- disqus %>.disqus.com/embed.js';
+ s.src = '//<%= disqus %>.disqus.com/embed.js';
s.setAttribute('data-timestamp', +new Date());
(d.head || d.body).appendChild(s);
})();
diff --git a/public/views/ga.ejs b/public/views/ga.ejs
index 180832d1..66d4acd9 100644
--- a/public/views/ga.ejs
+++ b/public/views/ga.ejs
@@ -12,7 +12,7 @@
m.parentNode.insertBefore(a, m)
})(window, document, 'script', '//www.google-analytics.com/analytics.js', 'ga');
-ga('create', '<%- GA %>', 'auto');
+ga('create', '<%= GA %>', 'auto');
ga('send', 'pageview');
<% } %>
\ No newline at end of file
diff --git a/public/views/head.ejs b/public/views/head.ejs
index f1cdff15..fb51b14f 100644
--- a/public/views/head.ejs
+++ b/public/views/head.ejs
@@ -4,7 +4,7 @@
-<%- title %>
+<%= title %>
<% if(useCDN) { %>
diff --git a/public/views/pretty.ejs b/public/views/pretty.ejs
index 502aae40..f810a5a9 100644
--- a/public/views/pretty.ejs
+++ b/public/views/pretty.ejs
@@ -9,12 +9,12 @@
<% if(typeof robots !== 'undefined' && robots) { %>
-
+
<% } %>
<% if(typeof description !== 'undefined' && description) { %>
-
+
<% } %>
- <%- title %>
+ <%= title %>
<% if(useCDN) { %>
@@ -59,7 +59,7 @@
<% } %>
- <%- body %>
+ <%= body %>