Mirrors/cloudcmd
1
0
Fork 0
mirror of https://github.com/coderaiser/cloudcmd.git synced 2026-08-04 05:33:10 +00:00
Code Issues Projects Releases Wiki Activity

fix(cloudfunc) XSS vulnerability: html in file name: allows executing malicious javascript code in the user's browser

Browse source
This commit is contained in:
coderaiser 2018-04-23 16:46:25 +03:00
parent c413d0ba6e
commit 23f4d4702c
3 changed files with 98 additions and 25 deletions
Download patch file Download diff file Expand all files Collapse all files

5
client/dom/index.js
View file

@ -10,9 +10,10 @@ const Util = require('../../common/util');
const {
getTitle,
FS,
Entity,
} = require('../../common/cloudfunc');
const {encode} = require('../../common/entity');
const DOMTree = require('./dom-tree');
const DOM = Object.assign({}, DOMTree, new CmdProto());
@ -747,7 +748,7 @@ function CmdProto() {
const dir = PREFIX + FS + Info.dirPath;
link.title = name;
link.innerHTML = Entity.encode(name);
link.innerHTML = encode(name);
link.href = dir + name;
current.setAttribute('data-name', 'js-file-' + name);