zhangyuheng/MrDoc
1
0
Fork 0
forked from mirror/MrDoc
Code Pull Requests Activity

修复ice富文本编辑器中插入图片URL链接的XSS漏洞

Browse Source
This commit is contained in:
zmister 2021-10-20 14:07:22 +08:00
parent 5034ca74f2
commit 46ef5326e4
4 changed files with 5 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
static/mrdoc/mrdoc.editor.js
View File

@ -393,7 +393,8 @@ insertImg = function(e){
// 按钮点击插入输入框图片链接
insertImgUrl = function(){
if(editor_mode == 3){
editor.addValue('<img src="' + $("#img_url_input").val() + '" />')
img_str = DOMPurify.sanitize('<img src="' + $("#img_url_input").val() + '" />',{ADD_TAGS: ['iframe']})
editor.addValue(img_str)
}else{
editor.insertValue("\n![](" + $("#img_url_input").val() + ")");
editor.focus()

1
template/app_doc/editor/create_base.html
View File

@ -234,6 +234,7 @@
{% elif editor_mode == 3 %}
<!-- iceEditor富文本编辑器 -->
<script src="{% static 'iceEditor/src/iceEditor.min.js' %}?version={{mrdoc_version}}"></script>
<script src="{% static 'editor.md/lib/purify.min.js' %}?version={{mrdoc_version}}"></script>
{% include 'app_doc/editor/tpl_editor_ice.html' %}
{% elif editor_mode == 4 %}
<!-- 在线表格 -->

2
template/app_doc/editor/create_doc.html
View File

@ -272,7 +272,7 @@
var content = editor.getHTML()
var pre_content = editor.getValue()
}else if(editor_mode == 3){
var content = editor.getHTML()
var content = DOMPurify.sanitize(editor.getHTML(),{ADD_TAGS: ['iframe']})
var pre_content = editor.getText()
}else if(editor_mode == 4){
var content = '';

2
template/app_doc/editor/modify_doc.html
View File

@ -249,7 +249,7 @@
var content = editor.getHTML()
var pre_content = editor.getValue()
}else if(editor_mode == 3){
var content = editor.getHTML()
var content = DOMPurify.sanitize(editor.getHTML(),{ADD_TAGS: ['iframe']})
var pre_content = editor.getText()
}else if(editor_mode == 4){
var content = '';