From edc3a31dfdb03e910d7355144280e281eeb582d5 Mon Sep 17 00:00:00 2001
From: "Cheng-Han, Wu" <jackymaxj@gmail.com>
Date: Wed, 20 Apr 2016 18:10:43 +0800
Subject: [PATCH] Fix XSS HTML replace might get wrong on the HTML comments in
 the code tags

---
 public/js/render.js | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/public/js/render.js b/public/js/render.js
index 9c1fa27..5c2b017 100644
--- a/public/js/render.js
+++ b/public/js/render.js
@@ -3,6 +3,10 @@ var whiteListAttr = ['id', 'class', 'style'];
 
 var filterXSSOptions = {
     allowCommentTag: true,
+    escapeHtml: function (html) {
+        // to allow html comment in multiple lines
+        return html.replace(/<(.*?)>/g, '&lt;$1&gt;');
+    },
     onIgnoreTag: function (tag, html, options) {
         // allow style in html
         if (whiteListTag.indexOf(tag) !== -1) {