mirrors/hedgedoc
1
0
Fork 0
mirror of https://github.com/hedgedoc/hedgedoc.git synced 2025-05-12 22:26:08 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

Replace embedding shortcode regexes with more specific ones to safeguard against xss attacks

Browse source 
Signed-off-by: Tilman Vatteroth <git@tilmanvatteroth.de>
This commit is contained in:
Tilman Vatteroth 2022-08-21 21:57:52 +02:00 • committed by Yannick Bungers
parent 9ab8bf3cac
commit 164fe21d18
2 changed files with 6 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

1
public/docs/release-notes.md
View file

@ -3,6 +3,7 @@
### Enhancements ### Enhancements
- Add dark mode toggle in mobile view - Add dark mode toggle in mobile view
- Replace embedding shortcode regexes with more specific ones to safeguard against xss attacks
### Bugfixes ### Bugfixes
- Fix a crash when using LDAP authentication with custom search attributes (thanks to [@aboettger-tuhh](https://github.com/aboettger-tuhh) for reporting) - Fix a crash when using LDAP authentication with custom search attributes (thanks to [@aboettger-tuhh](https://github.com/aboettger-tuhh) for reporting)

10
public/js/extra.js
View file

@ -1119,7 +1119,7 @@ md.renderer.rules.fence = (tokens, idx, options, env, self) => {
// youtube // youtube
const youtubePlugin = new Plugin( const youtubePlugin = new Plugin(
// regexp to match // regexp to match
/{%youtube\s*([\d\D]*?)\s*%}/, /{%youtube\s*([\w-]{11})\s*%}/,
(match, utils) => { (match, utils) => {
const videoid = match[1] const videoid = match[1]
@ -1137,7 +1137,7 @@ const youtubePlugin = new Plugin(
// vimeo // vimeo
const vimeoPlugin = new Plugin( const vimeoPlugin = new Plugin(
// regexp to match // regexp to match
/{%vimeo\s*([\d\D]*?)\s*%}/, /{%vimeo\s*(\d{6,11})\s*%}/,
(match, utils) => { (match, utils) => {
const videoid = match[1] const videoid = match[1]
@ -1152,7 +1152,7 @@ const vimeoPlugin = new Plugin(
// gist // gist
const gistPlugin = new Plugin( const gistPlugin = new Plugin(
// regexp to match // regexp to match
/{%gist\s*([\d\D]*?)\s*%}/, /{%gist\s*(\w+\/\w+)\s*%}/,
(match, utils) => { (match, utils) => {
const gistid = match[1] const gistid = match[1]
@ -1170,7 +1170,7 @@ const tocPlugin = new Plugin(
// slideshare // slideshare
const slidesharePlugin = new Plugin( const slidesharePlugin = new Plugin(
// regexp to match // regexp to match
/{%slideshare\s*([\d\D]*?)\s*%}/, /{%slideshare\s*(\w+\/[\w-]+)\s*%}/,
(match, utils) => { (match, utils) => {
const slideshareid = match[1] const slideshareid = match[1]
@ -1182,7 +1182,7 @@ const slidesharePlugin = new Plugin(
// speakerdeck // speakerdeck
const speakerdeckPlugin = new Plugin( const speakerdeckPlugin = new Plugin(
// regexp to match // regexp to match
/{%speakerdeck\s*([\d\D]*?)\s*%}/, /{%speakerdeck\s*(\w+\/[\w-]+)\s*%}/,
(match, utils) => { (match, utils) => {
const speakerdeckid = match[1] const speakerdeckid = match[1]