github/overleaf
1
0
Fork 0
mirror of https://github.com/overleaf/overleaf.git synced 2024-12-24 20:41:01 +00:00
Code Issues Projects Releases Packages Wiki Activity

Merge pull request #6525 from overleaf/jpa-harden-translations-sanitize

Browse source 
[web] scripts/translations: sanitize: double down on angular xss

GitOrigin-RevId: d08deab392942e593e920e648118f0e196af1740
This commit is contained in:
Timothée Alby 2022-02-02 11:24:45 +01:00 committed by Copybot
parent 58cf92620a
commit 22ee7d6da2
1 changed files with 3 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
services/web/scripts/translations/sanitize.js
View file

@ -25,6 +25,9 @@ function sanitize(input) {
a: ['href', 'class'], a: ['href', 'class'],
}, },
textFilter(text) { textFilter(text) {
// Block Angular XSS
if (text === '{') return '{'
if (text === '}') return '}'
return text return text
.replace(/\{\{/, '{{') .replace(/\{\{/, '{{')
.replace(/\}\}/, '}}') .replace(/\}\}/, '}}')