Discource-C/discourse
1
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-02-21 19:55:43 +00:00
Code Issues Packages Projects Releases Wiki Activity

SECURITY: Sanitize d-popover attributes (#13958)

Browse Source
This commit is contained in:
Bianca Nenciu 2021-08-05 16:39:17 +03:00 committed by GitHub
parent bb2c48b065
commit 38199424bc
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 9 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
app/assets/javascripts/discourse/app/lib/d-popover.js
View File

@ -16,8 +16,7 @@ const D_ARROW_HEIGHT = 10;
const D_HORIZONTAL_MARGIN = 5;
export const POPOVER_SELECTORS =
"[data-html-popover], [data-html-tooltip], [data-popover], [data-tooltip]";
export const POPOVER_SELECTORS = "[data-popover], [data-tooltip]";
export function hidePopover() {
getPopover().fadeOut().remove();
@ -55,11 +54,6 @@ export function showPopover(event, options = {}) {
}
function setPopoverHtmlContent($enteredElement, content) {
content =
content ||
$enteredElement.attr("data-html-popover") ||
$enteredElement.attr("data-html-tooltip");
replaceHtmlContent($enteredElement, content);
}

5
app/assets/javascripts/discourse/tests/unit/lib/sanitizer-test.js
View File

@ -136,6 +136,11 @@ module("Unit | Utility | sanitizer", function () {
);
cooked(`<div dir="rtl">RTL text</div>`, `<div dir="rtl">RTL text</div>`);
cooked(
`<div data-value="<something>" data-html-value="<something>"></div>`,
`<div data-value="&lt;something&gt;"></div>`
);
});
test("ids on headings", function (assert) {

4
app/assets/javascripts/pretty-text/addon/sanitizer.js
View File

@ -75,7 +75,9 @@ export function sanitize(text, allowLister) {
if (
(forAttr &&
(forAttr.indexOf("*") !== -1 || forAttr.indexOf(value) !== -1)) ||
(name.indexOf("data-") === 0 && forTag["data-*"]) ||
(name.indexOf("data-html-") === -1 &&
name.indexOf("data-") === 0 &&
forTag["data-*"]) ||
(tag === "a" &&
name === "href" &&
hrefAllowed(value, extraHrefMatchers)) ||