github-mirror/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2024-12-04 15:46:18 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

SECURITY: Correctly render link title in draft preview (#18958)

Browse Source 
The additional unescaping could cause link titles to be rendered
incorrectly.
This commit is contained in:
Bianca Nenciu 2022-11-09 15:54:47 +02:00 committed by GitHub
parent ce28fd2e1d
commit 3a985c82c7
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 27 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
app/assets/javascripts/discourse/app/lib/text.js
View File

@ -150,7 +150,6 @@ export function excerpt(cooked, length) {
resultLength += element.textContent.length;
}
} else if (element.tagName === "A") {
element.innerHTML = element.innerText;
result += element.outerHTML;
resultLength += element.innerText.length;
} else if (element.tagName === "IMG") {

27
app/assets/javascripts/discourse/tests/unit/lib/text-test.js Normal file
View File

@ -0,0 +1,27 @@
import { module, test } from "qunit";
import { cookAsync, excerpt } from "discourse/lib/text";
module("Unit | Utility | text", function () {
test("excerpt", async function (assert) {
let cooked = await cookAsync("Hello! :wave:");
assert.strictEqual(
await excerpt(cooked, 300),
'Hello! <img src="/images/emoji/google_classic/wave.png?v=12" title=":wave:" class="emoji" alt=":wave:" loading="lazy" width="20" height="20">'
);
cooked = await cookAsync("[:wave:](https://example.com)");
assert.strictEqual(
await excerpt(cooked, 300),
'<a href="https://example.com"><img src="/images/emoji/google_classic/wave.png?v=12" title=":wave:" class="emoji only-emoji" alt=":wave:" loading="lazy" width="20" height="20"></a>'
);
cooked = await cookAsync('<script>alert("hi")</script>');
assert.strictEqual(await excerpt(cooked, 300), "");
cooked = await cookAsync("[`<script>alert('hi')</script>`]()");
assert.strictEqual(
await excerpt(cooked, 300),
"<a><code>&lt;script&gt;alert('hi')&lt;/script&gt;</code></a>"
);
});
});