Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Appearance settings

Commit d588595

Browse filesBrowse files
committed
omit anchors with XSS href via a whitelist in convertToSVG
1 parent 92a9850 commit d588595
Copy full SHA for d588595

File tree

1 file changed

+10
-1
lines changed
Filter options

1 file changed

+10
-1
lines changed

‎src/lib/svg_text_utils.js

Copy file name to clipboardExpand all lines: src/lib/svg_text_utils.js
+10-1Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -221,6 +221,8 @@ var TAG_STYLES = {
221221
em: 'font-style:italic;font-weight:bold'
222222
};
223223

224+
var PROTOCOLS = ['http:', 'https:', 'mailto'];
225+
224226
var STRIP_TAGS = new RegExp('</?(' + Object.keys(TAG_STYLES).join('|') + ')( [^>]*)?/?>', 'g');
225227

226228
util.plainText = function(_str){
@@ -252,7 +254,14 @@ function convertToSVG(_str){
252254
if(tag === 'a'){
253255
if(close) return '</a>';
254256
else if(extra.substr(0,4).toLowerCase() !== 'href') return '<a>';
255-
else return '<a xlink:show="new" xlink:href' + extra.substr(4) + '>';
257+
else {
258+
var dummyAnchor = document.createElement('a');
259+
dummyAnchor.href = extra.split('href=')[1].replace(/["']/g, '');
260+
261+
if(PROTOCOLS.indexOf(dummyAnchor.protocol) === -1) return '<a>';
262+
263+
return '<a xlink:show="new" xlink:href' + extra.substr(4) + '>';
264+
}
256265
}
257266
else if(tag === 'br') return '<br>';
258267
else if(close) {

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.