From 33774c11b989a6a8aa2517e1a83d39c43741fc90 Mon Sep 17 00:00:00 2001 From: Sheogorath Date: Wed, 21 Nov 2018 11:11:47 +0100 Subject: Update from to-markdown to turndown We got a security alert for a regular expression DoS attack on our used library `to-markdown`. After checking `to-markdown` to be maintained or not, it turned out they renamed the library to `turndown`. So upgrading to `turndown` should fix this vulnerbility. References: https://www.npmjs.com/package/to-markdown https://github.com/domchristie/turndown/wiki/Migrating-from-to-markdown-to-Turndown Signed-off-by: Sheogorath --- public/js/index.js | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) (limited to 'public') diff --git a/public/js/index.js b/public/js/index.js index c2969e92..a845b5d3 100644 --- a/public/js/index.js +++ b/public/js/index.js @@ -12,7 +12,7 @@ require('../css/site.css') require('highlight.js/styles/github-gist.css') -import toMarkdown from 'to-markdown' +import TurndownService from 'turndown' import { saveAs } from 'file-saver' import randomColor from 'randomcolor' @@ -1498,7 +1498,12 @@ $('#snippetExportModalConfirm').click(function () { }) function parseToEditor (data) { - var parsed = toMarkdown(data) + var turndownService = new TurndownService({ + defaultReplacement: function (innerHTML, node) { + return node.isBlock ? '\n\n' + node.outerHTML + '\n\n' : node.outerHTML + } + }) + var parsed = turndownService.turndown(data) if (parsed) { replaceAll(parsed) } } -- cgit v1.2.3