Discource-C
/
discourse
mirror of https://github.com/discourse/discourse.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

FIX: Sanitize custom quote attributes

This commit is contained in:
Robin Ward 2014-04-21 09:20:39 -04:00
parent faec113710
commit 4dc20e6855
2 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
app/assets/javascripts/discourse/dialects/quote_dialect.js
View File

@ -1,6 +1,9 @@
/** /**
Support for quoting other users. Support for quoting other users.
**/ **/
var esc = Handlebars.Utils.escapeExpression;
Discourse.Dialect.replaceBlock({ Discourse.Dialect.replaceBlock({
start: new RegExp("\\[quote=?([^\\[\\]]+)?\\]([\\s\\S]*)", "igm"), start: new RegExp("\\[quote=?([^\\[\\]]+)?\\]([\\s\\S]*)", "igm"),
stop: '[/quote]', stop: '[/quote]',
@ -19,7 +22,7 @@ Discourse.Dialect.replaceBlock({
if (i > 0) { if (i > 0) {
var assignment = p.split(':'); var assignment = p.split(':');
if (assignment[0] && assignment[1]) { if (assignment[0] && assignment[1]) {
params['data-' + assignment[0]] = assignment[1].trim(); params['data-' + esc(assignment[0])] = esc(assignment[1].trim());
} }
} }
}); });

3
test/javascripts/lib/bbcode_test.js
View File

@ -99,6 +99,9 @@ test("quotes", function() {
"<aside class=\"quote\"><blockquote><p><em>test</em></p></blockquote></aside>", "<aside class=\"quote\"><blockquote><p><em>test</em></p></blockquote></aside>",
"it doesn't insert a new line for italics"); "it doesn't insert a new line for italics");
format("[quote,script='a'><script>alert('test');//':a][/quote]",
"<aside class=\"quote\" data-script=&#x27;a&#x27;&gt;&lt;script&gt;alert(&#x27;test&#x27;);//&#x27;=\"a\"><blockquote></blockquote></aside>",
"It will not create a script tag within an attribute");
}); });
test("quote formatting", function() { test("quote formatting", function() {