luisgulo/focalboard
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Always stop event propagation for click on the link generated from markdown. (#1039)

Browse source 
Co-authored-by: Jesús Espino <jespinog@gmail.com>
Co-authored-by: Hossein <hahmadia@users.noreply.github.com>
Co-authored-by: Harshil Sharma <harshilsharma63@gmail.com>
This commit is contained in:
kamre 2021-08-24 20:11:48 +07:00 committed by GitHub
parent f9c76d8129
commit e4e1f2d94a
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 2 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
webapp/src/utils.test.ts
View file

@ -25,7 +25,7 @@ describe('utils', () => {
describe('htmlFromMarkdown', () => {
test('should not allow XSS on links href on the webapp', () => {
expect(Utils.htmlFromMarkdown('[]("xss-attack="true"other="whatever)')).toBe('<p><a target="_blank" rel="noreferrer" href="%22xss-attack=%22true%22other=%22whatever" title="" ></a></p>')
expect(Utils.htmlFromMarkdown('[]("xss-attack="true"other="whatever)')).toBe('<p><a target="_blank" rel="noreferrer" href="%22xss-attack=%22true%22other=%22whatever" title="" onclick="event.stopPropagation();"></a></p>')
})
test('should not allow XSS on links href on the desktop app', () => {

2
webapp/src/utils.ts
View file

@ -151,7 +151,7 @@ class Utils {
'rel="noreferrer" ' +
`href="${encodeURI(href || '')}" ` +
`title="${title ? encodeURI(title) : ''}" ` +
((window as any).openInNewBrowser ? 'onclick="event.stopPropagation(); openInNewBrowser && openInNewBrowser(event.target.href);"' : '') +
`onclick="event.stopPropagation();${((window as any).openInNewBrowser ? ' openInNewBrowser && openInNewBrowser(event.target.href);' : '')}"` +
'>' + contents + '</a>'
}
const html = marked(text.replace(/</g, '&lt;'), {renderer, breaks: true})