dawy_go/vnote
1
0
Fork 0
mirror of https://gitee.com/vnotex/vnote.git synced 2025-07-05 05:49:53 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix todo list with XSS

Browse Source
This commit is contained in:
Le Tan 2024-06-27 21:48:59 +08:00
parent 743e63edbf
commit 44b5251045
6 changed files with 31 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/data/extra/extra.qrc
View File

@ -51,7 +51,8 @@
<file>web/js/markdown-it/markdown-it-texmath.js</file>
<file>web/js/markdown-it/markdown-it-mark.min.js</file>
<file>web/js/markdown-it/markdown-it-inject-linenumbers.js</file>
<file>web/js/markdown-it/markdown-it-xss.min.js</file>
<file>web/js/markdown-it/xss.min.js</file>
<file>web/js/markdown-it/markdown-it-xss.js</file>
<file>web/js/markdown-it/markdown-it-implicit-figure.js</file>
<file>web/js/markdown-it/markdown-it.min.js</file>
<file>web/js/markdownit.js</file>

3
src/data/extra/web/js/markdown-it/README.md
View File

@ -36,9 +36,6 @@ Vitaly Puzrin
v0.0.0
Modified by Le Tan
# [markdown-it-xss](https://github.com/yzyeengang/markdown-it-xss)
v1.0.0
# [markdonw-it-anchor](https://github.com/valeriangalliat/markdown-it-anchor)
v6.0.1

21
src/data/extra/web/js/markdown-it/markdown-it-xss.js Normal file
View File

@ -0,0 +1,21 @@
(function(f){if(typeof exports==="object"&&typeof module!=="undefined"){module.exports=f()}else if(typeof define==="function"&&define.amd){define([],f)}else{var g;if(typeof window!=="undefined"){g=window}else if(typeof global!=="undefined"){g=global}else if(typeof self!=="undefined"){g=self}else{g=this}g.markdownItXSS = f()}})(function(){var define,module,exports;return (function e(t,n,r){function s(o,u){if(!n[o]){if(!t[o]){var a=typeof require=="function"&&require;if(!u&&a)return a(o,!0);if(i)return i(o,!0);var f=new Error("Cannot find module '"+o+"'");throw f.code="MODULE_NOT_FOUND",f}var l=n[o]={exports:{}};t[o][0].call(l.exports,function(e){var n=t[o][1][e];return s(n?n:e)},l,l.exports,e,t,n,r)}return n[o].exports}var i=typeof require=="function"&&require;for(var o=0;o<r.length;o++)s(r[o]);return s})({1:[function(require,module,exports){
'use strict';
module.exports = function protect_xss(md, opts = {}) {
const proxy = (tokens, idx, options, env, self) => self.renderToken(tokens, idx, options);
const defaultHtmlInlineRenderer = md.renderer.rules.html_inline || proxy;
function protectFromXSS(html) {
return filterXSS(html, opts);
}
function filterContent(tokens, idx, options, env, slf) {
tokens[idx].content = protectFromXSS(tokens[idx].content);
return defaultHtmlInlineRenderer(tokens, idx, options, env, slf);
}
md.renderer.rules.html_inline = filterContent;
};
},{}]},{},[1])(1)
});

1
src/data/extra/web/js/markdown-it/markdown-it-xss.min.js vendored
View File

File diff suppressed because one or more lines are too long

1
src/data/extra/web/js/markdown-it/xss.min.js vendored Normal file
View File

File diff suppressed because one or more lines are too long

9
src/data/extra/web/js/markdownit.js
View File

@ -208,9 +208,14 @@ class MarkdownIt extends VxWorker {
if (window.vxOptions.protectFromXss) {
let scriptFolderPath = Utils.parentFolder(document.currentScript.src);
Utils.loadScripts([scriptFolderPath + '/markdown-it/markdown-it-xss.min.js'],
Utils.loadScripts([scriptFolderPath + '/markdown-it/xss.min.js',
scriptFolderPath + '/markdown-it/markdown-it-xss.js'],
() => {
this.mdit.use(window['markdown-it-xss']);
this.mdit.use(window.markdownItXSS, {
whiteList: {
input: ["class", "disabled", "type", "checked"],
}
});
});
}