Home Explore Help
Register Sign In
Apq
/
logseq
mirror of https://github.com/logseq/logseq.git
1
0
Fork 0
Files Issues 0 Wiki
Browse Source

fix(plugins): avoid xss for the injected readme html content

charlie 5 months ago
parent
5efaf84507
commit
4cdf49aedd
3 changed files with 4 additions and 2 deletions
Unified View Show Diff Stats
  1. 1 0
      gulpfile.js
  2. 2 1
      resources/marketplace.html
  3. 1 1
      src/main/frontend/components/plugins.cljs

+ 1 - 0
gulpfile.js
View File 

@@ -72,6 +72,7 @@ const common = {
 
         'node_modules/react-dom/umd/react-dom.production.min.js',
 
         'node_modules/react-dom/umd/react-dom.production.min.js',
 
         'node_modules/react-dom/umd/react-dom.development.js',
 
         'node_modules/react-dom/umd/react-dom.development.js',
 
         'node_modules/prop-types/prop-types.min.js',
 
         'node_modules/prop-types/prop-types.min.js',
 
+        'node_modules/dompurify/dist/purify.js',
 
       ]).pipe(gulp.dest(path.join(outputPath, 'js'))),
 
       ]).pipe(gulp.dest(path.join(outputPath, 'js'))),
 
       () => gulp.src([
 
       () => gulp.src([
 
         'node_modules/@tabler/icons-react/dist/umd/tabler-icons-react.min.js',
 
         'node_modules/@tabler/icons-react/dist/umd/tabler-icons-react.min.js',

+ 2 - 1
resources/marketplace.html
View File 

@@ -69,6 +69,7 @@
 
 <body>
 
 <body>
 
 <div id="app"></div>
 
 <div id="app"></div>
 
 <script src="./js/marked.min.js"></script>
 
 <script src="./js/marked.min.js"></script>
 
+<script src="./js/purify.js"></script>
 
 <script>
 
 <script>
 
   ;(async function () {
 
   ;(async function () {
 
     const app = document.getElementById('app')
 
     const app = document.getElementById('app')
 
@@ -131,7 +132,7 @@
 
       }
 
       }
 
 
 
       content = marked.parse(content).replace('src="./', `src="${fixLink('')}`)
 
       content = marked.parse(content).replace('src="./', `src="${fixLink('')}`)
 
-      setContent(content)
 
+      setContent(DOMPurify.sanitize(content))
 
     }
 
     }
 
 
 
     // load default
 
     // load default

+ 1 - 1
src/main/frontend/components/plugins.cljs
View File 

@@ -202,7 +202,7 @@
 
 
 
 (rum/defc remote-readme-display
 
 (rum/defc remote-readme-display
 
   [{:keys [repo]} _content]
 
   [{:keys [repo]} _content]
 
-  (let [src (str (if (string/includes? js/location.href "logseq")
 
+  (let [src (str (if (string/includes? js/location.host "logseq")
 
                    "./static/" "./") "marketplace.html?repo=" repo)]
 
                    "./static/" "./") "marketplace.html?repo=" repo)]
 
     [:iframe.lsp-frame-readme {:src src}]))
 
     [:iframe.lsp-frame-readme {:src src}]))