The_Great_Archive/cryptpad
1
0
Fork 0
mirror of https://github.com/cryptpad/cryptpad.git synced 2026-09-12 19:49:59 +05:00
Code Issues Packages Projects Releases Wiki Activity

Disable srcdoc attribute in iframe

Browse Source
This commit is contained in:
yflory 2026-02-05 17:21:40 +01:00
parent 505541e2b9
commit 7150a92728
2 changed files with 15 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
www/common/diffMarked.js
View File

@ -447,11 +447,17 @@ define([
if (restrictedTags.indexOf(root.nodeName.toUpperCase()) === -1) { return true; }
return root.getAttribute && /^(blob\:|\/lib\/pdfjs)/.test(root.getAttribute('src'));
};
// Remove any iframe with srcdoc attribute
var checkSrcDoc = function (root) {
if (restrictedTags.indexOf(root.nodeName.toUpperCase()) === -1) { return true; }
return !(root.getAttribute && root.getAttribute('srcdoc'));
};
var removeForbiddenTags = function (root) {
if (!root) { return; }
if (forbiddenTags.indexOf(root.nodeName.toUpperCase()) !== -1) { removeNode(root); }
if (!checkSrc(root)) { removeNode(root); }
if (!checkSrc(root)) { removeNode(root); }
if (!checkSrcDoc(root)) { removeNode(root); }
slice(root.children).forEach(removeForbiddenTags);
};

12
www/common/jscolor.js
View File

@ -14,6 +14,8 @@
* See usage examples at http://jscolor.com/examples/
*/
// NOTE: custom changes for CryptPad:
// - "new Function" code has been commented out for security reasons
"use strict";
@ -62,6 +64,7 @@ var jsc = {
}
var opts = {};
/*
if (optsStr) {
try {
opts = (new Function ('return (' + optsStr + ')'))();
@ -69,6 +72,7 @@ var jsc = {
jsc.warn('Error parsing jscolor options: ' + eParseError + ':\n' + optsStr);
}
}
*/
targetElm.jscolor = new jsc.jscolor(targetElm, opts);
}
}
@ -685,11 +689,11 @@ var jsc = {
dispatchFineChange : function (thisObj) {
if (thisObj.onFineChange) {
var callback;
if (typeof thisObj.onFineChange === 'string') {
callback = new Function(thisObj.onFineChange);
} else {
// if (typeof thisObj.onFineChange === 'string') {
// callback = new Function(thisObj.onFineChange);
// } else {
callback = thisObj.onFineChange;
}
// }
callback(thisObj);
}
},