xss sanitizer touchups

editormd.js

@@ -2,12 +2,12 @@
  * Editor.md
  *
  * @file        editormd.js 
- * @version     v1.7.5 
+ * @version     v1.7.7 
  * @description Open source online markdown editor.
  * @license     MIT License
  * @author      Pandao
  * {@link       https://github.com/pandao/editor.md}
- * @updateTime  2022-06-20
+ * @updateTime  2022-06-23
  */
 
 ;(function(factory) {
@@ -59,7 +59,7 @@
     };
 
     editormd.title        = editormd.$name = "Editor.md";
-    editormd.version      = "1.7.6";
+    editormd.version      = "1.7.7";
     editormd.homePage     = "https://pandao.github.io/editor.md/";
     editormd.classPrefix  = "editormd-";
 

lib/xss.js

@@ -11,7 +11,7 @@ var _ = require("./util");
 
 function getDefaultWhiteList() {
   return {
-    a: ["target", "href", "title"],
+    a: ["target", "href", "title", "rel"],
     abbr: ["title"],
     address: [],
     area: ["shape", "coords", "href", "alt"],
@@ -195,6 +195,27 @@ function safeAttrValue(tag, name, value, cssFilter) {
     // ) {
     //   return "";
     // }
+
+    REGEXP_DEFAULT_ON_TAG_ATTR_4.lastIndex = 0;
+    if (REGEXP_DEFAULT_ON_TAG_ATTR_4.test(value)) {
+      return "";
+    }
+
+    REGEXP_DEFAULT_ON_TAG_ATTR_5.lastIndex = 0
+    if (REGEXP_DEFAULT_ON_TAG_ATTR_5.test(value)) {
+      return "";
+    }
+
+    if (tag == "iframe"){
+      if (
+        !(
+            value.substr(0, 7) === "http://" ||
+            value.substr(0, 8) === "https://"
+        )
+      ) {
+        return ""
+      }
+    }
   } else if (name === "background") {
     // filter `background` attribute (maybe no use)
     // `javascript:`
@@ -238,7 +259,7 @@ var REGEXP_ATTR_VALUE_NEWLINE = /&newline;?/gim;
 // var REGEXP_DEFAULT_ON_TAG_ATTR_3 = /\/\*|\*\//gm;
 var REGEXP_DEFAULT_ON_TAG_ATTR_4 =
   /((j\s*a\s*v\s*a|v\s*b|l\s*i\s*v\s*e)\s*s\s*c\s*r\s*i\s*p\s*t\s*|m\s*o\s*c\s*h\s*a):/gi;
-// var REGEXP_DEFAULT_ON_TAG_ATTR_5 = /^[\s"'`]*(d\s*a\s*t\s*a\s*)\:/gi;
+var REGEXP_DEFAULT_ON_TAG_ATTR_5 = /^[\s"'`]*(d\s*a\s*t\s*a\s*)\:/gi;
 // var REGEXP_DEFAULT_ON_TAG_ATTR_6 = /^[\s"'`]*(d\s*a\s*t\s*a\s*)\:\s*image\//gi;
 var REGEXP_DEFAULT_ON_TAG_ATTR_7 =
   /e\s*x\s*p\s*r\s*e\s*s\s*s\s*i\s*o\s*n\s*\(.*/gi;

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ibm-skills-network/editor.md",
-  "version": "1.7.6",
+  "version": "1.7.7",
   "description": "Open source online markdown editor.",
   "directories": {
     "doc": "docs",

src/editormd.js

@@ -47,7 +47,7 @@
     };
 
     editormd.title        = editormd.$name = "Editor.md";
-    editormd.version      = "1.7.6";
+    editormd.version      = "1.7.7";
     editormd.homePage     = "https://pandao.github.io/editor.md/";
     editormd.classPrefix  = "editormd-";