f.weber/homebrewery
0
0
Fork 0
mirror of https://github.com/naturalcrit/homebrewery.git synced 2026-08-06 04:37:37 +00:00
Code Wiki Activity

Merge pull request #4905 from G-Ambatte/fixSafeHTML

Browse Source 
Fix safeHTML attribute check
This commit is contained in:
Víctor Losada Hernández
2026-08-01 22:40:04 +02:00
committed by GitHub
parent 7a3d1019af c1ad9209a0
commit e6af56fd4b
2 changed files with 10 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
client/homebrew/brewRenderer/safeHTML.js
+4 -4
View File
@@ -32,12 +32,12 @@ function safeHTML(htmlString) {
return; return;
} }
// Check remaining elements for blacklisted attributes // Check remaining elements for blacklisted attributes
for (const attribute of element.attributes){ [...element.attributes].forEach((attribute)=>{
if(blacklistAttrs.some((test)=>{return test(attribute);})) { if(blacklistAttrs.some((test)=>{return test(attribute);})) {
element.removeAttribute(attribute.localName); element.removeAttribute(attribute.name);
break; return;
}; };
}; });
}); });
return div.innerHTML; return div.innerHTML;
tests/html/safeHTML.test.js
+6
View File
@@ -43,6 +43,12 @@ test('Javascript via inline event handler - onMouseOver', function() {
expect(rendered).toBe('<div>Hover over me</div>'); expect(rendered).toBe('<div>Hover over me</div>');
}); });
test('Javascript via multiple inline event handlers - onClick + onMouseOver', function() {
const source = `<div onclick="alert('This is a JavaScript injection via inline event handler')" onmouseover="alert('This is a JavaScript injection via inline event handler')">Hover over or Click me</div>`;
const rendered = safeHTML(source);
expect(rendered).toBe('<div>Hover over or Click me</div>');
});
test('Javascript via data attribute', function() { test('Javascript via data attribute', function() {
const source = `<div data-code="javascript:alert('This is a JavaScript injection via data attribute')">Test</div>`; const source = `<div data-code="javascript:alert('This is a JavaScript injection via data attribute')">Test</div>`;
const rendered = safeHTML(source); const rendered = safeHTML(source);