depau/HackMD
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Fix possible XSS in yaml-metadata and turn using ejs escape syntax than external lib [Security Issue]

Browse source
This commit is contained in:
Wu Cheng-Han 2016-11-26 22:55:31 +08:00
parent b43e63dd21
commit 9d4ede4cff
8 changed files with 15 additions and 24 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
lib/response.js
View file

@ -186,7 +186,6 @@ function showPublishNote(req, res, next) {
if (!meta) meta = {};
var createtime = note.createdAt;
var updatetime = note.lastchangeAt;
var text = S(body).escapeHTML().s;
var title = models.Note.decodeTitle(note.title);
title = models.Note.generateWebTitle(meta.title || title);
var origin = config.serverurl;
@ -197,7 +196,7 @@ function showPublishNote(req, res, next) {
createtime: createtime,
updatetime: updatetime,
url: origin,
body: text,
body: body,
useCDN: config.usecdn,
owner: note.owner ? note.owner.id : null,
ownerprofile: note.owner ? models.User.parseProfile(note.owner.profile) : null,
@ -258,7 +257,6 @@ function actionInfo(req, res, note) {
if (!meta) meta = {};
var createtime = note.createdAt;
var updatetime = note.lastchangeAt;
var text = S(body).escapeHTML().s;
var title = models.Note.decodeTitle(note.title);
var data = {
title: meta.title || title,
@ -572,7 +570,6 @@ function showPublishSlide(req, res, next) {
if (!meta) meta = {};
var createtime = note.createdAt;
var updatetime = note.lastchangeAt;
var text = S(body).escapeHTML().s;
var title = models.Note.decodeTitle(note.title);
title = models.Note.generateWebTitle(meta.title || title);
var origin = config.serverurl;
@ -583,7 +580,7 @@ function showPublishSlide(req, res, next) {
createtime: createtime,
updatetime: updatetime,
url: origin,
body: text,
body: body,
meta: JSON.stringify(obj.meta || {}),
useCDN: config.usecdn,
owner: note.owner ? note.owner.id : null,

5
public/js/pretty.js
View file

@ -4,9 +4,6 @@ require('../css/site.css');
require('highlight.js/styles/github-gist.css');
/* other vendors plugin */
var S = require('string');
var extra = require('./extra');
var md = extra.md;
var finishView = extra.finishView;
@ -22,7 +19,7 @@ var scrollToHash = extra.scrollToHash;
var preventXSS = require('./render').preventXSS;
var markdown = $("#doc.markdown-body");
var text = S(markdown.html()).unescapeHTML().s;
var text = markdown.text();
var lastMeta = md.meta;
md.meta = {};
var rendered = md.render(text);

3
public/js/slide.js
View file

@ -2,9 +2,6 @@ require('../css/extra.css');
require('../css/site.css');
require('../css/slide.css');
/* other vendors plugin */
var S = require('string');
var extraModule = require('./extra');
var md = extraModule.md;
var updateLastChange = extraModule.updateLastChange;

2
public/views/disqus.ejs
View file

@ -5,7 +5,7 @@ var disqus_config = function () {
};
(function() {
var d = document, s = d.createElement('script');
s.src = '//<%- disqus %>.disqus.com/embed.js';
s.src = '//<%= disqus %>.disqus.com/embed.js';
s.setAttribute('data-timestamp', +new Date());
(d.head || d.body).appendChild(s);
})();

2
public/views/ga.ejs
View file

@ -12,7 +12,7 @@
m.parentNode.insertBefore(a, m)
})(window, document, 'script', '//www.google-analytics.com/analytics.js', 'ga');
ga('create', '<%- GA %>', 'auto');
ga('create', '<%= GA %>', 'auto');
ga('send', 'pageview');
</script>
<% } %>

2
public/views/head.ejs
View file

@ -4,7 +4,7 @@
<meta name="apple-mobile-web-app-capable" content="yes">
<meta name="apple-mobile-web-app-status-bar-style" content="black">
<meta name="mobile-web-app-capable" content="yes">
<title><%- title %></title>
<title><%= title %></title>
<link rel="icon" type="image/png" href="<%- url %>/favicon.png">
<link rel="apple-touch-icon" href="<%- url %>/apple-touch-icon.png">
<% if(useCDN) { %>

8
public/views/pretty.ejs
View file

@ -9,12 +9,12 @@
<meta name="apple-mobile-web-app-status-bar-style" content="black">
<meta name="mobile-web-app-capable" content="yes">
<% if(typeof robots !== 'undefined' && robots) { %>
<meta name="robots" content="<%- robots %>">
<meta name="robots" content="<%= robots %>">
<% } %>
<% if(typeof description !== 'undefined' && description) { %>
<meta name="description" content="<%- description %>">
<meta name="description" content="<%= description %>">
<% } %>
<title><%- title %></title>
<title><%= title %></title>
<link rel="icon" type="image/png" href="<%- url %>/favicon.png">
<link rel="apple-touch-icon" href="<%- url %>/apple-touch-icon.png">
<% if(useCDN) { %>
@ -59,7 +59,7 @@
<% } %>
</small>
</div>
<div id="doc" class="container markdown-body"><%- body %></div>
<div id="doc" class="container markdown-body"><%= body %></div>
<div class="ui-toc dropup unselectable hidden-print" style="display:none;">
<div class="pull-right dropdown">
<a id="tocLabel" class="ui-toc-label btn btn-default" data-toggle="dropdown" href="#" role="button" aria-haspopup="true" aria-expanded="false" title="Table of content">

10
public/views/slide.ejs
View file

@ -6,12 +6,12 @@
<meta name="apple-mobile-web-app-status-bar-style" content="black">
<meta name="mobile-web-app-capable" content="yes">
<% if(typeof robots !== 'undefined' && robots) { %>
<meta name="robots" content="<%- robots %>">
<meta name="robots" content="<%= robots %>">
<% } %>
<% if(typeof description !== 'undefined' && description) { %>
<meta name="description" content="<%- description %>">
<meta name="description" content="<%= description %>">
<% } %>
<title><%- title %></title>
<title><%= title %></title>
<link rel="icon" type="image/png" href="<%- url %>/favicon.png">
<link rel="apple-touch-icon" href="<%- url %>/apple-touch-icon.png">
<% if(useCDN) { %>
@ -55,10 +55,10 @@
<body>
<div class="container">
<div class="reveal">
<div class="slides" style="display: none;"><%- body %></div>
<div class="slides" style="display: none;"><%= body %></div>
</div>
<div id="meta" style="display: none;"><%- meta %></div>
<div id="meta" style="display: none;"><%= meta %></div>
<div class="footer">
<div class="unselectable hidden-print" style="color: #777;">