From 9d4ede4cffae47b9fd81ffbd0f2edff47c29e224 Mon Sep 17 00:00:00 2001
From: Wu Cheng-Han
Date: Sat, 26 Nov 2016 22:55:31 +0800
Subject: Fix possible XSS in yaml-metadata and turn using ejs escape syntax
 than external lib [Security Issue]

---
 public/js/pretty.js     |  5 +----
 public/js/slide.js      |  3 ---
 public/views/disqus.ejs |  2 +-
 public/views/ga.ejs     |  2 +-
 public/views/head.ejs   |  2 +-
 public/views/pretty.ejs |  8 ++++----
 public/views/slide.ejs  | 10 +++++-----
 7 files changed, 13 insertions(+), 19 deletions(-)

(limited to 'public')

diff --git a/public/js/pretty.js b/public/js/pretty.js
index f43df90c..c1a471a1 100644
--- a/public/js/pretty.js
+++ b/public/js/pretty.js
@@ -4,9 +4,6 @@ require('../css/site.css');
 
 require('highlight.js/styles/github-gist.css');
 
-/* other vendors plugin */
-var S = require('string');
-
 var extra = require('./extra');
 var md = extra.md;
 var finishView = extra.finishView;
@@ -22,7 +19,7 @@ var scrollToHash = extra.scrollToHash;
 var preventXSS = require('./render').preventXSS;
 
 var markdown = $("#doc.markdown-body");
-var text = S(markdown.html()).unescapeHTML().s;
+var text = markdown.text();
 var lastMeta = md.meta;
 md.meta = {};
 var rendered = md.render(text);
diff --git a/public/js/slide.js b/public/js/slide.js
index a8411570..8d45219e 100644
--- a/public/js/slide.js
+++ b/public/js/slide.js
@@ -2,9 +2,6 @@ require('../css/extra.css');
 require('../css/site.css');
 require('../css/slide.css');
 
-/* other vendors plugin */
-var S = require('string');
-
 var extraModule = require('./extra');
 var md = extraModule.md;
 var updateLastChange = extraModule.updateLastChange;
diff --git a/public/views/disqus.ejs b/public/views/disqus.ejs
index ed991a41..cceaa85c 100644
--- a/public/views/disqus.ejs
+++ b/public/views/disqus.ejs
@@ -5,7 +5,7 @@ var disqus_config = function () {
 };
 (function() {
     var d = document, s = d.createElement('script');
-    s.src = '//<%- disqus %>.disqus.com/embed.js';
+    s.src = '//<%= disqus %>.disqus.com/embed.js';
     s.setAttribute('data-timestamp', +new Date());
     (d.head || d.body).appendChild(s);
 })();
diff --git a/public/views/ga.ejs b/public/views/ga.ejs
index 180832d1..66d4acd9 100644
--- a/public/views/ga.ejs
+++ b/public/views/ga.ejs
@@ -12,7 +12,7 @@
     m.parentNode.insertBefore(a, m)
 })(window, document, 'script', '//www.google-analytics.com/analytics.js', 'ga');
 
-ga('create', '<%- GA %>', 'auto');
+ga('create', '<%= GA %>', 'auto');
 ga('send', 'pageview');
 </script>
 <% } %>
\ No newline at end of file
diff --git a/public/views/head.ejs b/public/views/head.ejs
index f1cdff15..fb51b14f 100644
--- a/public/views/head.ejs
+++ b/public/views/head.ejs
@@ -4,7 +4,7 @@
 <meta name="apple-mobile-web-app-capable" content="yes">
 <meta name="apple-mobile-web-app-status-bar-style" content="black">
 <meta name="mobile-web-app-capable" content="yes">
-<title><%- title %></title>
+<title><%= title %></title>
 <link rel="icon" type="image/png" href="<%- url %>/favicon.png">
 <link rel="apple-touch-icon" href="<%- url %>/apple-touch-icon.png">
 <% if(useCDN) { %>
diff --git a/public/views/pretty.ejs b/public/views/pretty.ejs
index 502aae40..f810a5a9 100644
--- a/public/views/pretty.ejs
+++ b/public/views/pretty.ejs
@@ -9,12 +9,12 @@
     <meta name="apple-mobile-web-app-status-bar-style" content="black">
     <meta name="mobile-web-app-capable" content="yes">
     <% if(typeof robots !== 'undefined' && robots) { %>
-    <meta name="robots" content="<%- robots %>">
+    <meta name="robots" content="<%= robots %>">
     <% } %>
     <% if(typeof description !== 'undefined' && description) { %>
-    <meta name="description" content="<%- description %>">
+    <meta name="description" content="<%= description %>">
     <% } %>
-    <title><%- title %></title>
+    <title><%= title %></title>
     <link rel="icon" type="image/png" href="<%- url %>/favicon.png">
 	<link rel="apple-touch-icon" href="<%- url %>/apple-touch-icon.png">
 	<% if(useCDN) { %>
@@ -59,7 +59,7 @@
             <% } %>
         </small>
     </div>
-    <div id="doc" class="container markdown-body"><%- body %></div>
+    <div id="doc" class="container markdown-body"><%= body %></div>
     <div class="ui-toc dropup unselectable hidden-print" style="display:none;">
         <div class="pull-right dropdown">
             <a id="tocLabel" class="ui-toc-label btn btn-default" data-toggle="dropdown" href="#" role="button" aria-haspopup="true" aria-expanded="false" title="Table of content">
diff --git a/public/views/slide.ejs b/public/views/slide.ejs
index df23988d..cd3be9aa 100644
--- a/public/views/slide.ejs
+++ b/public/views/slide.ejs
@@ -6,12 +6,12 @@
         <meta name="apple-mobile-web-app-status-bar-style" content="black">
         <meta name="mobile-web-app-capable" content="yes">
         <% if(typeof robots !== 'undefined' && robots) { %>
-        <meta name="robots" content="<%- robots %>">
+        <meta name="robots" content="<%= robots %>">
         <% } %>
         <% if(typeof description !== 'undefined' && description) { %>
-        <meta name="description" content="<%- description %>">
+        <meta name="description" content="<%= description %>">
         <% } %>
-        <title><%- title %></title>
+        <title><%= title %></title>
         <link rel="icon" type="image/png" href="<%- url %>/favicon.png">
         <link rel="apple-touch-icon" href="<%- url %>/apple-touch-icon.png">
         <% if(useCDN) { %>
@@ -55,10 +55,10 @@
     <body>
         <div class="container">
             <div class="reveal">
-                <div class="slides" style="display: none;"><%- body %></div>
+                <div class="slides" style="display: none;"><%= body %></div>
             </div>
 
-            <div id="meta" style="display: none;"><%- meta %></div>
+            <div id="meta" style="display: none;"><%= meta %></div>
 
             <div class="footer">
                 <div class="unselectable hidden-print" style="color: #777;">
-- 
cgit v1.2.3