deblan-mirror/Choices
deblan-mirror/Choices
1
0
Fork 0
mirror of https://github.com/Choices-js/Choices.git synced 2024-05-02 22:03:11 +02:00
Code Issues Projects Releases Wiki Activity

Fix xss vulnerability(escape html in input)

Browse source
This commit is contained in:
c5254061 2018-03-23 18:51:50 +03:00
parent b49980d169
commit e46ae74209
2 changed files with 10 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
src/scripts/src/constants.js
View file

@ -1,3 +1,4 @@
import { stripHTML } from './lib/utils';
export const DEFAULT_CLASSNAMES = {
containerOuter: 'choices',
@ -62,7 +63,7 @@ export const DEFAULT_CONFIG = {
noChoicesText: 'No choices to choose from',
itemSelectText: 'Press to select',
uniqueItemText: 'Only unique values can be added.',
addItemText: value => `Press Enter to add <b>"${value}"</b>`,
addItemText: value => `Press Enter to add <b>"${stripHTML(value)}"</b>`,
maxItemText: maxItemCount => `Only ${maxItemCount} values can be added.`,
itemComparer: (choice, item) => (choice === item),
fuseOptions: {

16
src/scripts/src/lib/utils.js
View file

@ -421,15 +421,15 @@ export const isScrolledIntoView = (el, parent, direction = 1) => {
};
/**
* Remove html tags from a string
* @param {String} Initial string/html
* Escape html in the string
* @param {String} html Initial string/html
* @return {String} Sanitised string
*/
export const stripHTML = function(html) {
const el = document.createElement('DIV');
el.innerHTML = html;
return el.textContent || el.innerText || '';
};
export const stripHTML = html =>
html.replace(/&/g, '&amp;')
.replace(/>/g, '&rt;')
.replace(/</g, '&lt;')
.replace(/"/g, '&quot;');
/**
* Adds animation to an element and removes it upon animation completion
@ -490,7 +490,7 @@ export const getWidthOfInput = (input) => {
let width = input.offsetWidth;
if (value) {
const testEl = strToEl(`<span>${value}</span>`);
const testEl = strToEl(`<span>${stripHTML(value)}</span>`);
testEl.style.position = 'absolute';
testEl.style.padding = '0';
testEl.style.top = '-9999px';