public/Boostnote
1
0
Fork 0
mirror of https://github.com/BoostIo/Boostnote synced 2025-12-14 10:16:26 +00:00
Code Issues Releases Wiki Activity

fix XSS bug

Browse Source
This commit is contained in:
Baptiste Augrain
2018-09-15 15:24:59 +02:00
parent 7af77384e7
commit b03c2a1f80
2 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
browser/lib/markdown-it-fence.js
View File

@@ -120,7 +120,7 @@ module.exports = function (md, renderers, defaultRenderer) {
alt: ['paragraph', 'reference', 'blockquote', 'list'] alt: ['paragraph', 'reference', 'blockquote', 'list']
}) })
for (let name in renderers) { for (const name in renderers) {
md.renderer.rules[`${name}_fence`] = (tokens, index) => renderers[name](tokens[index]) md.renderer.rules[`${name}_fence`] = (tokens, index) => renderers[name](tokens[index])
} }

2
browser/lib/markdown-it-sanitize-html.js
View File

@@ -14,7 +14,7 @@ module.exports = function sanitizePlugin (md, options) {
options options
) )
} }
if (state.tokens[tokenIdx].type === 'fence') { if (state.tokens[tokenIdx].type === '_fence') {
// escapeHtmlCharacters has better performance // escapeHtmlCharacters has better performance
state.tokens[tokenIdx].content = escapeHtmlCharacters( state.tokens[tokenIdx].content = escapeHtmlCharacters(
state.tokens[tokenIdx].content, state.tokens[tokenIdx].content,