OpenCloud
/
riot-web
mirror of https://github.com/vector-im/riot-web
1
0
Fork 0
Code Issues Releases Wiki Activity

Sanitise for *, fix style issues

pull/21833/head
Luke Barnard 2017-02-27 11:23:37 +00:00
parent ae03244e6e
commit 886b0a3f13
1 changed files with 6 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
src/HtmlUtils.js
View File

@ -141,18 +141,20 @@ var sanitizeHtmlParams = {
attribs.rel = 'noopener'; // https://mathiasbynens.github.io/rel-noopener/ attribs.rel = 'noopener'; // https://mathiasbynens.github.io/rel-noopener/
return { tagName: tagName, attribs : attribs }; return { tagName: tagName, attribs : attribs };
}, },
'font': function(tagName, attribs) { '*': function(tagName, attribs) {
// Only allow certain CSS attributes to avoid XSS attacks // Only allow certain CSS attributes to avoid XSS attacks
// Sanitizing values to avoid `url(...)` and `expression(...)` attacks // Sanitizing values to avoid `url(...)` and `expression(...)` attacks
if (!attribs.style) { if (!attribs.style) {
return { tagName: tagName, attribs : attribs }; return { tagName: tagName, attribs: attribs };
} }
const pairs = attribs.style.split(';'); const pairs = attribs.style.split(';');
let sanitisedStyle = ""; let sanitisedStyle = "";
for (let i = 0; i < pairs.length; i++) { for (let i = 0; i < pairs.length; i++) {
const pair = pairs[i].split(':'); const pair = pairs[i].split(':');
if (!Object.keys(ALLOWED_CSS).includes(pair[0]) || !ALLOWED_CSS[pair[0]].test(pair[1])) { if (!Object.keys(ALLOWED_CSS).includes(pair[0]) ||
!ALLOWED_CSS[pair[0]].test(pair[1])
) {
continue; continue;
} }
sanitisedStyle += pair[0] + ":" + pair[1] + ";"; sanitisedStyle += pair[0] + ":" + pair[1] + ";";
@ -164,7 +166,7 @@ var sanitizeHtmlParams = {
delete attribs.style; delete attribs.style;
} }
return { tagName: tagName, attribs : attribs }; return { tagName: tagName, attribs: attribs };
}, },
}, },
}; };