smig/excalidraw
1
0
Fork 0
mirror of https://github.com/excalidraw/excalidraw.git synced 2025-05-03 10:00:07 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

feat: make HTML attribute sanitization stricter (#8977)

Browse source 
* feat: make HTML attribute sanitization stricter

* fix double escape
This commit is contained in:
David Luzar 2025-01-05 21:45:04 +01:00 • committed by GitHub
parent c84babf574
commit b63689c230
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
5 changed files with 32 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

13
packages/excalidraw/utils.ts
View file

@ -1225,3 +1225,16 @@ export class PromisePool<T> {
});
}
}
export const sanitizeHTMLAttribute = (html: string) => {
return (
html
// note, if we're not doing stupid things, escaping " is enough,
// but we might end up doing stupid things
.replace(/&/g, "&amp;")
.replace(/"/g, "&quot;")
.replace(/'/g, "&#39;")
.replace(/>/g, "&gt;")
.replace(/</g, "&lt;")
);
};