admin/n8n-enterprise-unlocked
1
0
Fork 0
mirror of https://github.com/Abdulazizzn/n8n-enterprise-unlocked.git synced 2025-12-20 19:32:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(editor): Fixing XSS vulnerability in toast messages (#10329)

Browse Source 
Co-authored-by: Adi <aditya@netroy.in>
This commit is contained in:
Milorad FIlipović
2024-08-08 16:28:51 +02:00
committed by GitHub
parent b6c47c0e32
commit 38bdd9f5d0
5 changed files with 25 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
packages/editor-ui/src/utils/htmlUtils.ts
View File

@@ -18,6 +18,10 @@ export function sanitizeHtml(dirtyHtml: string) {
}
if (ALLOWED_HTML_ATTRIBUTES.includes(name) || name.startsWith('data-')) {
// href is allowed but we need to sanitize certain protocols
if (name === 'href' && !value.match(/^https?:\/\//gm)) {
return '';
}
return `${name}="${friendlyAttrValue(value)}"`;
}