libre-service.eu/pad.libre-service.eu-etherpad
libre-service.eu/pad.libre-service.eu-etherpad
1
0
Fork 0
mirror of https://github.com/ether/etherpad-lite.git synced 2025-02-01 03:12:42 +01:00
Code Issues Projects Releases Wiki Activity

chat: Use jQuery to build the chat message DOM object

Browse source 
This reduces the likelihood of accidentally introducing an XSS
vulnerability.
This commit is contained in:
Richard Hansen 2021-04-08 23:39:08 -04:00 committed by webzwo0i
parent 74554d36a5
commit a3a0ff7bc1
1 changed files with 16 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

25
src/static/js/chat.js
View file

@ -164,15 +164,22 @@ exports.chat = (() => {
// Call chat message hook // Call chat message hook
hooks.aCallAll('chatNewMessage', ctx, () => { hooks.aCallAll('chatNewMessage', ctx, () => {
const cls = authorClass(ctx.author); const cls = authorClass(ctx.author);
const html = const chatMsg = $('<p>')
`<p data-authorId='${padutils.escapeHtml(ctx.author)}' class='${cls}'>` + .attr('data-authorId', ctx.author)
`<b>${padutils.escapeHtml(ctx.authorName)}:</b>` + .addClass(cls)
// ctx.text was HTML-escaped before calling the hook, and ctx.timeStr couldn't have had .append($('<b>').text(`${ctx.authorName}:`))
// any HTML. Hook functions are trusted to not introduce an XSS vulnerability by adding .append($('<span>')
// unescaped user input to either ctx.text or ctx.timeStr. .addClass('time')
`<span class='time ${cls}'>${ctx.timeStr}</span> ${ctx.text}</p>`; .addClass(cls)
if (isHistoryAdd) $(html).insertAfter('#chatloadmessagesbutton'); // Hook functions are trusted to not introduce an XSS vulnerability by adding
else $('#chattext').append(html); // unescaped user input to ctx.timeStr.
.html(ctx.timeStr))
.append(' ')
// ctx.text was HTML-escaped before calling the hook. Hook functions are trusted to not
// introduce an XSS vulnerability by adding unescaped user input.
.append($('<div>').html(ctx.text).contents());
if (isHistoryAdd) chatMsg.insertAfter('#chatloadmessagesbutton');
else $('#chattext').append(chatMsg);
// should we increment the counter?? // should we increment the counter??
if (increment && !isHistoryAdd) { if (increment && !isHistoryAdd) {