kyy/swagger-ui
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: markdown sanitization of form tag (#7146)

Browse Source
This commit is contained in:
Tim Lai
2021-03-31 11:03:57 -07:00
committed by GitHub
parent 4abbc62b87
commit f5b84e59ce
2 changed files with 13 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
src/core/components/providers/markdown.jsx
View File

@@ -68,7 +68,7 @@ export function sanitizer(str, { useUnsafeMarkdown = false } = {}) {
return DomPurify.sanitize(str, { return DomPurify.sanitize(str, {
ADD_ATTR: ["target"], ADD_ATTR: ["target"],
FORBID_TAGS: ["style"], FORBID_TAGS: ["style", "form"],
ALLOW_DATA_ATTR, ALLOW_DATA_ATTR,
FORBID_ATTR, FORBID_ATTR,
}) })

12
test/unit/xss/markdown-script-sanitization.jsx
View File

@@ -16,6 +16,12 @@ describe("Markdown Script Sanitization", function() {
const el = render(<Markdown source={str} />) const el = render(<Markdown source={str} />)
expect(el.html()).toEqual(`<div class="markdown"><p><img src="x"></p>\n</div>`) expect(el.html()).toEqual(`<div class="markdown"><p><img src="x"></p>\n</div>`)
}) })
it("sanitizes <form> elements", function() {
const str = `"<form action='https://do.not.use.url/fake' method='post' action='java'><input type='email' id='email' placeholder='Email-address' name='email' value=''><button type='submit'>Login</button>"`
const el = render(<Markdown source={str} />)
expect(el.html()).toEqual(`<div class="markdown"><p>&quot;</p><input value name="email" placeholder="Email-address" id="email" type="email"><button type="submit">Login</button>&quot;<p></p>\n</div>`)
})
}) })
describe("OAS 3", function() { describe("OAS 3", function() {
@@ -30,5 +36,11 @@ describe("Markdown Script Sanitization", function() {
const el = render(<OAS3Markdown source={str} />) const el = render(<OAS3Markdown source={str} />)
expect(el.html()).toEqual(`<div class="renderedMarkdown"><p><img src="x"></p></div>`) expect(el.html()).toEqual(`<div class="renderedMarkdown"><p><img src="x"></p></div>`)
}) })
it("sanitizes <form> elements", function () {
const str = `"<form action='https://do.not.use.url/fake' method='post' action='java'><input type='email' id='email' placeholder='Email-address' name='email' value=''><button type='submit'>Login</button>"`
const el = render(<OAS3Markdown source={str} />)
expect(el.html()).toEqual(`<div class="renderedMarkdown"><p>&quot;</p><input value name="email" placeholder="Email-address" id="email" type="email"><button type="submit">Login</button>&quot;<p></p></div>`)
})
}) })
}) })