prevent entering html in comments
Massimo Melina committed
Sep 28, 2023 at 17:51 UTC
f23b0a401afed11eedf8baee055c52368e43ac03
3 files changed
+8
-8
admin/src/CustomHtmlPage.ts
+1
-6
@@ -5,7 +5,7 @@ import { Field, FieldProps, SelectField } from '@hfs/mui-grid-form'
5
import { apiCall, useApiEx } from './api'
6
import { Alert, Box, TextField } from '@mui/material'
7
import Editor from 'react-simple-code-editor'
8
-import { Dict, focusableSelector, IconBtn, isCtrlKey, modifiedSx, reloadBtn, wikiLink } from './misc';
8
+import { Dict, escapeHTML, focusableSelector, IconBtn, isCtrlKey, modifiedSx, reloadBtn, wikiLink } from './misc';
9
import { Save } from '@mui/icons-material'
10
import _ from 'lodash'
11
import { useDebounce } from 'usehooks-ts'
@@ -61,11 +61,6 @@ export default function CustomHtmlPage() {
61
}
62
}
63
64
-function escapeHTML(unsafe: string) {
65
- return unsafe.replace(/[\u0000-\u002F\u003A-\u0040\u005B-\u0060\u007B-\u00FF]/g,
66
- c => '&#' + ('000' + c.charCodeAt(0)).slice(-4) + ';')
67
-}
68
-
64
type OP = ComponentProps<typeof Editor>
65
type Already = 'highlight' | 'padding' | 'tabSize' | 'insertSpaces' | 'ignoreTabKey'
66
type TextEditorProps = Omit<OP, Already> & Partial<Pick<OP, Already>>
src/cross.ts
+5
@@ -267,4 +267,9 @@ export function ipLocalHost(ip: string) {
267
268
export function ipForUrl(ip: string) {
269
return ip.includes(':') ? '[' + ip + ']' : ip
270
+}
271
+
272
+export function escapeHTML(text: string) {
273
+ return text.replace(/[\u0000-\u002F\u003A-\u0040\u005B-\u0060\u007B-\u00FF]/g,
274
+ c => '&#' + ('000' + c.charCodeAt(0)).slice(-4) + ';')
275
}
\ No newline at end of file
src/upload.ts
+2
-2
@@ -8,7 +8,7 @@ import {
8
} from './const'
9
import { basename, dirname, extname, join } from 'path'
10
import fs from 'fs'
11
-import { Callback, dirTraversal, loadFileAttr, storeFileAttr, try_ } from './misc'
11
+import { Callback, dirTraversal, escapeHTML, loadFileAttr, storeFileAttr, try_ } from './misc'
12
import { notifyClient } from './frontEndApis'
13
import { defineConfig } from './config'
14
import { getFreeDiskSync } from './util-os'
@@ -107,7 +107,7 @@ export function uploadWriter(base: VfsNode, path: string, ctx: Koa.Context) {
107
if (err)
108
console.error("couldn't rename temp to", dest, String(err))
109
else if (ctx.query.comment)
110
- setCommentFor(dest, String(ctx.query.comment))
110
+ setCommentFor(dest, escapeHTML(String(ctx.query.comment)))
111
if (resumable)
112
delayedDelete(resumable, 0)
113
})