修复ice富文本编辑器中插入图片URL链接的XSS漏洞

zmister2016 · Oct 20, 2021 · 46ef532 · 46ef532
1 parent 5034ca7
commit 46ef532
Show file tree

Hide file tree

Showing 4 changed files with 5 additions and 3 deletions.
diff --git a/static/mrdoc/mrdoc.editor.js b/static/mrdoc/mrdoc.editor.js
@@ -393,7 +393,8 @@ insertImg = function(e){
 // 按钮点击插入输入框图片链接
 insertImgUrl = function(){
     if(editor_mode == 3){
-        editor.addValue('<img src="' + $("#img_url_input").val() + '" />')
+        img_str = DOMPurify.sanitize('<img src="' + $("#img_url_input").val() + '" />',{ADD_TAGS: ['iframe']})
+        editor.addValue(img_str)
     }else{
         editor.insertValue("\n![](" + $("#img_url_input").val() + ")");
         editor.focus()

diff --git a/template/app_doc/editor/create_base.html b/template/app_doc/editor/create_base.html
@@ -234,6 +234,7 @@
         {% elif editor_mode == 3 %}
             <!-- iceEditor富文本编辑器 -->
             <script src="{% static 'iceEditor/src/iceEditor.min.js' %}?version={{mrdoc_version}}"></script>
+            <script src="{% static 'editor.md/lib/purify.min.js' %}?version={{mrdoc_version}}"></script>
             {% include 'app_doc/editor/tpl_editor_ice.html' %}
         {% elif editor_mode == 4 %}
             <!-- 在线表格 -->

diff --git a/template/app_doc/editor/create_doc.html b/template/app_doc/editor/create_doc.html
@@ -272,7 +272,7 @@
                 var content = editor.getHTML()
                 var pre_content = editor.getValue()
             }else if(editor_mode == 3){
-                var content = editor.getHTML()
+                var content = DOMPurify.sanitize(editor.getHTML(),{ADD_TAGS: ['iframe']})
                 var pre_content = editor.getText()
             }else if(editor_mode == 4){
                 var content  = '';

diff --git a/template/app_doc/editor/modify_doc.html b/template/app_doc/editor/modify_doc.html
@@ -249,7 +249,7 @@
                 var content = editor.getHTML()
                 var pre_content = editor.getValue()
             }else if(editor_mode == 3){
-                var content = editor.getHTML()
+                var content = DOMPurify.sanitize(editor.getHTML(),{ADD_TAGS: ['iframe']})
                 var pre_content = editor.getText()
             }else if(editor_mode == 4){
                 var content  = '';