Joplin
/
joplin
mirror of https://github.com/laurent22/joplin.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Desktop: Security: Disallow map and area tags (#8479)

pull/8484/head
Henry Heino 2023-07-15 03:56:12 -07:00 committed by GitHub
parent 68ffdc5c0f
commit 7c52c3e9a8
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 15 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
packages/app-cli/tests/md_to_html/sanitize_16.html
View File

@ -1 +1 @@
<map name="test" class="jop-noMdConv"><area coords="0,0,1000,1000" href="#" class="jop-noMdConv"/></map><img usemap="#test" src="https://github.com/Ry0taK.png" class="jop-noMdConv"/>
<img usemap="#test" src="https://github.com/Ry0taK.png" class="jop-noMdConv"/>

16
packages/renderer/htmlUtils.ts
View File

@ -203,6 +203,11 @@ class HtmlUtils {
'embed', 'link', 'meta', 'noscript', 'button', 'form',
'input', 'select', 'textarea', 'option', 'optgroup',
'svg',
// Disallow map and area tags: <area ...> links are currently not
// sanitized as well as <a ...> links, allowing potential sandbox
// escape.
'map', 'area',
];
const parser = new htmlparser2.Parser({
@ -300,8 +305,15 @@ class HtmlUtils {
if (current === name.toLowerCase()) tagStack.pop();
if (disallowedTags.includes(current)) {
disallowedTagDepth--;
// The Markdown sanitization code can result in calls like this:
// sanitizeHtml('<invlaid>')
// sanitizeHtml('</invalid>')
// Thus, we need to be able to remove '</invalid>', even if there is no
// corresponding opening tag.
if (disallowedTags.includes(current) || disallowedTags.includes(name)) {
if (disallowedTagDepth > 0) {
disallowedTagDepth--;
}
return;
}