Почетна Преглед Помоћ
Пријавите се
computer_glamour
/
privatebin-mirror
огледало од https://github.com/PrivateBin/PrivateBin
1
0
Креирај огранак 0
Датотеке Дискусије 0 Вики
Преглед изворни кода

updating DOMPurify library, simplifying its use, ensuring HTML entities get escaped before formatting paste - regression introduced in #258, reported in #269

El RIDO пре 8 година
родитељ
6093f0cc9c
комит
bb54d46c7e
6 измењених фајлова са 15 додато и 14 уклоњено
Један поглед Покажи статистику Diff
  1. 9 8
      js/privatebin.js
  2. 0 0
      js/purify-1.0.3.js
  3. 0 0
      js/purify.min.js
  4. 2 2
      js/test.js
  5. 2 2
      tpl/bootstrap.php
  6. 2 2
      tpl/page.php

+ 9 - 8
js/privatebin.js
Прегледај датотеку 

@@ -1700,7 +1700,7 @@ jQuery.PrivateBin = function($, sjcl, Base64, RawDeflate) {
 
             }
 
             }
 
 
 
             // set sanitized and linked text
 
             // set sanitized and linked text
 
-            var sanitizedLinkedText = DOMPurify.sanitize(Helper.urls2links(text), {SAFE_FOR_JQUERY: true});
 
+            var sanitizedLinkedText = DOMPurify.sanitize(Helper.urls2links(text));
 
             $plainText.html(sanitizedLinkedText);
 
             $plainText.html(sanitizedLinkedText);
 
             $prettyPrint.html(sanitizedLinkedText);
 
             $prettyPrint.html(sanitizedLinkedText);
 
 
 
@@ -1713,7 +1713,7 @@ jQuery.PrivateBin = function($, sjcl, Base64, RawDeflate) {
 
                     });
 
                     });
 
                     // let showdown convert the HTML and sanitize HTML *afterwards*!
 
                     // let showdown convert the HTML and sanitize HTML *afterwards*!
 
                     $plainText.html(
 
                     $plainText.html(
 
-                        DOMPurify.sanitize(converter.makeHtml(text), {SAFE_FOR_JQUERY: true})
 
+                        DOMPurify.sanitize(converter.makeHtml(text))
 
                     );
 
                     );
 
                     // add table classes from bootstrap css
 
                     // add table classes from bootstrap css
 
                     $plainText.find('table').addClass('table-condensed table-bordered');
 
                     $plainText.find('table').addClass('table-condensed table-bordered');
 
@@ -1727,8 +1727,7 @@ jQuery.PrivateBin = function($, sjcl, Base64, RawDeflate) {
 
 
 
                     $prettyPrint.html(
 
                     $prettyPrint.html(
 
                         DOMPurify.sanitize(
 
                         DOMPurify.sanitize(
 
-                            prettyPrintOne(Helper.urls2links(text), null, true),
 
-                            {SAFE_FOR_JQUERY: true}
 
+                            prettyPrintOne(Helper.urls2links(text), null, true)
 
                         )
 
                         )
 
                     );
 
                     );
 
                     // fall through, as the rest is the same
 
                     // fall through, as the rest is the same
 
@@ -1824,6 +1823,8 @@ jQuery.PrivateBin = function($, sjcl, Base64, RawDeflate) {
 
          */
 
          */
 
         me.setText = function(newText)
 
         me.setText = function(newText)
 
         {
 
         {
 
+            // escape HTML entities
 
+            newText = $('<div />').text(newText).html();
 
             if (text !== newText) {
 
             if (text !== newText) {
 
                 text = newText;
 
                 text = newText;
 
                 isChanged = true;
 
                 isChanged = true;
 
@@ -2223,8 +2224,7 @@ jQuery.PrivateBin = function($, sjcl, Base64, RawDeflate) {
 
             // set & parse text
 
             // set & parse text
 
             $commentEntryData.html(
 
             $commentEntryData.html(
 
                 DOMPurify.sanitize(
 
                 DOMPurify.sanitize(
 
-                    Helper.urls2links(commentText),
 
-                    {SAFE_FOR_JQUERY: true}
 
+                    Helper.urls2links(commentText)
 
                 )
 
                 )
 
             );
 
             );
 
 
 
@@ -2529,7 +2529,7 @@ jQuery.PrivateBin = function($, sjcl, Base64, RawDeflate) {
 
             for (var i = 0; i < $head.length; i++) {
 
             for (var i = 0; i < $head.length; i++) {
 
                 newDoc.write($head[i].outerHTML);
 
                 newDoc.write($head[i].outerHTML);
 
             }
 
             }
 
-            newDoc.write('</head><body><pre>' + DOMPurify.sanitize(paste, {SAFE_FOR_JQUERY: true}) + '</pre></body></html>');
 
+            newDoc.write('</head><body><pre>' + DOMPurify.sanitize(paste) + '</pre></body></html>');
 
             newDoc.close();
 
             newDoc.close();
 
         }
 
         }
 
 
 
@@ -3939,10 +3939,11 @@ jQuery.PrivateBin = function($, sjcl, Base64, RawDeflate) {
 
             // first load translations
 
             // first load translations
 
             I18n.loadTranslations();
 
             I18n.loadTranslations();
 
 
 
+            DOMPurify.setConfig({SAFE_FOR_JQUERY: true});
 
+
 
             // initialize other modules/"classes"
 
             // initialize other modules/"classes"
 
             Alert.init();
 
             Alert.init();
 
             Model.init();
 
             Model.init();
 
-
 
             AttachmentViewer.init();
 
             AttachmentViewer.init();
 
             DiscussionViewer.init();
 
             DiscussionViewer.init();
 
             Editor.init();
 
             Editor.init();

Разлика између датотеке није приказан због своје велике величине
+ 0 - 0
js/purify-1.0.3.js


Разлика између датотеке није приказан због своје велике величине
+ 0 - 0
js/purify.min.js


+ 2 - 2
js/test.js
Прегледај датотеку 

@@ -42,7 +42,7 @@ require('./prettify');
 
 global.prettyPrint = window.PR.prettyPrint;
 
 global.prettyPrint = window.PR.prettyPrint;
 
 global.prettyPrintOne = window.PR.prettyPrintOne;
 
 global.prettyPrintOne = window.PR.prettyPrintOne;
 
 global.showdown = require('./showdown-1.6.1');
 
 global.showdown = require('./showdown-1.6.1');
 
-global.DOMPurify = require('./purify.min');
 
+global.DOMPurify = require('./purify-1.0.3');
 
 require('./bootstrap-3.3.7');
 
 require('./bootstrap-3.3.7');
 
 require('./privatebin');
 
 require('./privatebin');
 
 
 
@@ -1422,7 +1422,7 @@ describe('PasteViewer', function () {
 
                 results.push(
 
                 results.push(
 
                     $('#placeholder').hasClass('hidden') &&
 
                     $('#placeholder').hasClass('hidden') &&
 
                     !$.PrivateBin.PasteViewer.isPrettyPrinted() &&
 
                     !$.PrivateBin.PasteViewer.isPrettyPrinted() &&
 
-                    $.PrivateBin.PasteViewer.getText() == text
 
+                    $.PrivateBin.PasteViewer.getText() == $('<div />').text(text).html()
 
                 );
 
                 );
 
                 if (format == 'markdown') {
 
                 if (format == 'markdown') {
 
                     results.push(
 
                     results.push(

+ 2 - 2
tpl/bootstrap.php
Прегледај датотеку 

@@ -66,11 +66,11 @@ endif;
 
 if ($MARKDOWN):
 
 if ($MARKDOWN):
 
 ?>
 
 ?>
 
 		<script type="text/javascript" src="js/showdown-1.6.1.js" integrity="sha512-e6kAsBTgFnTBnEQXrq8BV6+XFwxb3kyWHeEPOl+KhxaWt3xImE2zAW2+yP3E2CQ7F9yoJl1poVU9qxkOEtVsTQ==" crossorigin="anonymous"></script>
 
 		<script type="text/javascript" src="js/showdown-1.6.1.js" integrity="sha512-e6kAsBTgFnTBnEQXrq8BV6+XFwxb3kyWHeEPOl+KhxaWt3xImE2zAW2+yP3E2CQ7F9yoJl1poVU9qxkOEtVsTQ==" crossorigin="anonymous"></script>
 
-		<script type="text/javascript" src="js/purify.min.js?<?php echo rawurlencode($VERSION); ?>" integrity="sha512-jJuy143F5Oy7oS3VkjzeJGBxIUuQ1H0eSjuvLGD3FiQzeu8Pwp5vI/jQ2dxlxSrzejmNMicdLHnIqH7R8Ft0lQ==" crossorigin="anonymous"></script>
 
+		<script type="text/javascript" src="js/purify-1.0.3.js?<?php echo rawurlencode($VERSION); ?>" integrity="sha512-uhzhZJSgc+XJoaxCOjiuRzQaf5klPlSSVKGw69+zT72hhfLbVwB4jbwI+f7NRucuRz6u0aFGMeZ+0PnGh73iBQ==" crossorigin="anonymous"></script>
 
 <?php
 
 <?php
 
 endif;
 
 endif;
 
 ?>
 
 ?>
 
-		<script type="text/javascript" src="js/privatebin.js?<?php echo rawurlencode($VERSION); ?>" integrity="sha512-EvNAh1GXOoUiGZ/W8iPtzsce06bvVHy6+ajJztmfSgdQcKMPoj0dB8j1FC90MEChl7MOeR4xozvDymH/6HwIlA==" crossorigin="anonymous"></script>
 
+		<script type="text/javascript" src="js/privatebin.js?<?php echo rawurlencode($VERSION); ?>" integrity="sha512-51v9MtL1fUeIOp2VekfHq4VR6kdR/SyYqkAT1WGRZXDP5+ct6A1qktVW9HNNL6EXYQbMpzgVuYUIZ6HhULcGSA==" crossorigin="anonymous"></script>
 
 		<!--[if lt IE 10]>
 
 		<!--[if lt IE 10]>
 
 		<style type="text/css">body {padding-left:60px;padding-right:60px;} #ienotice {display:block;} #oldienotice {display:block;}</style>
 
 		<style type="text/css">body {padding-left:60px;padding-right:60px;} #ienotice {display:block;} #oldienotice {display:block;}</style>
 
 		<![endif]-->
 
 		<![endif]-->

+ 2 - 2
tpl/page.php
Прегледај датотеку 

@@ -44,11 +44,11 @@ endif;
 
 if ($MARKDOWN):
 
 if ($MARKDOWN):
 
 ?>
 
 ?>
 
 		<script type="text/javascript" src="js/showdown-1.6.1.js" integrity="sha512-e6kAsBTgFnTBnEQXrq8BV6+XFwxb3kyWHeEPOl+KhxaWt3xImE2zAW2+yP3E2CQ7F9yoJl1poVU9qxkOEtVsTQ==" crossorigin="anonymous"></script>
 
 		<script type="text/javascript" src="js/showdown-1.6.1.js" integrity="sha512-e6kAsBTgFnTBnEQXrq8BV6+XFwxb3kyWHeEPOl+KhxaWt3xImE2zAW2+yP3E2CQ7F9yoJl1poVU9qxkOEtVsTQ==" crossorigin="anonymous"></script>
 
-		<script type="text/javascript" src="js/purify.min.js?<?php echo rawurlencode($VERSION); ?>" integrity="sha512-jJuy143F5Oy7oS3VkjzeJGBxIUuQ1H0eSjuvLGD3FiQzeu8Pwp5vI/jQ2dxlxSrzejmNMicdLHnIqH7R8Ft0lQ==" crossorigin="anonymous"></script>
 
+		<script type="text/javascript" src="js/purify-1.0.3.js?<?php echo rawurlencode($VERSION); ?>" integrity="sha512-uhzhZJSgc+XJoaxCOjiuRzQaf5klPlSSVKGw69+zT72hhfLbVwB4jbwI+f7NRucuRz6u0aFGMeZ+0PnGh73iBQ==" crossorigin="anonymous"></script>
 
 <?php
 
 <?php
 
 endif;
 
 endif;
 
 ?>
 
 ?>
 
-		<script type="text/javascript" src="js/privatebin.js?<?php echo rawurlencode($VERSION); ?>" integrity="sha512-EvNAh1GXOoUiGZ/W8iPtzsce06bvVHy6+ajJztmfSgdQcKMPoj0dB8j1FC90MEChl7MOeR4xozvDymH/6HwIlA==" crossorigin="anonymous"></script>
 
+		<script type="text/javascript" src="js/privatebin.js?<?php echo rawurlencode($VERSION); ?>" integrity="sha512-51v9MtL1fUeIOp2VekfHq4VR6kdR/SyYqkAT1WGRZXDP5+ct6A1qktVW9HNNL6EXYQbMpzgVuYUIZ6HhULcGSA==" crossorigin="anonymous"></script>
 
 		<!--[if lt IE 10]>
 
 		<!--[if lt IE 10]>
 
 		<style type="text/css">body {padding-left:60px;padding-right:60px;} #ienotice {display:block;} #oldienotice {display:block;}</style>
 
 		<style type="text/css">body {padding-left:60px;padding-right:60px;} #ienotice {display:block;} #oldienotice {display:block;}</style>
 
 		<![endif]-->
 
 		<![endif]-->

Неке датотеке нису приказане због велике количине промена