osr-plastic/osr-discourse-src
Archived
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

FIX: remove dangerous support for style/background attributes in polls

Browse Source
This commit is contained in:
Régis Hanol
2015-05-15 11:08:51 +02:00
parent fdbcc31a9c
commit a3fb2c002c
5 changed files with 8 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files
plugins/poll/assets/javascripts/poll_dialect.js
+2 -17
View File
@@ -5,8 +5,7 @@
const DATA_PREFIX = "data-poll-";
const DEFAULT_POLL_NAME = "poll";
const WHITELISTED_ATTRIBUTES = ["type", "name", "min", "max", "step", "order", "color", "background", "status"];
const WHITELISTED_STYLES = ["color", "background"];
const WHITELISTED_ATTRIBUTES = ["type", "name", "min", "max", "step", "order", "status"];
const ATTRIBUTES_REGEX = new RegExp("(" + WHITELISTED_ATTRIBUTES.join("|") + ")=['\"]?[^\\s\\]]+['\"]?", "g");
@@ -81,21 +80,9 @@
// TODO: remove non whitelisted content
// generate <li> styles (if any)
var styles = [];
WHITELISTED_STYLES.forEach(function(style) {
if (attributes[DATA_PREFIX + style]) {
styles.push(style + ":" + attributes[DATA_PREFIX + style]);
}
});
var style = styles.join(";");
// add option id (hash) + style
// add option id (hash)
for (o = 1; o < contents[0].length; o++) {
var attr = {};
// apply styles if any
if (style.length > 0) { attr["style"] = style; }
// compute md5 hash of the content of the option
attr[DATA_PREFIX + "option-id"] = md5(JSON.stringify(contents[0][o].slice(1)));
// store options attributes
@@ -178,6 +165,4 @@
Discourse.Markdown.whiteListTag("a", "class", /^button (cast-votes|toggle-results)/);
Discourse.Markdown.whiteListTag("li", "data-*");
Discourse.Markdown.whiteListTag("li", "style", /^(color=#?\w+;)?(background=#?\w+;)?$/);
})();