From 067cfe2d1eedc5a58e5548785858e38fbaa0e84b Mon Sep 17 00:00:00 2001
From: Max Wu
Date: Fri, 28 Dec 2018 16:42:55 +0800
Subject: Fix to escape html comment tag [Security Issue]

Signed-off-by: Max Wu <jackymaxj@gmail.com>
---
 public/js/render.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'public/js')

diff --git a/public/js/render.js b/public/js/render.js
index ff5e2bf2..87e5cfdf 100644
--- a/public/js/render.js
+++ b/public/js/render.js
@@ -45,7 +45,7 @@ var filterXSSOptions = {
     // allow comment tag
     if (tag === '!--') {
             // do not filter its attributes
-      return html
+      return html.replace(/<(?!!--)/g, '&lt;').replace(/-->/g, '__HTML_COMMENT_END__').replace(/>/g, '&gt;').replace(/__HTML_COMMENT_END__/g, '-->')
     }
   },
   onTagAttr: function (tag, name, value, isWhiteAttr) {
-- 
cgit v1.2.3