From 06c93999209b344caca81af50e6c54acab3931a8 Mon Sep 17 00:00:00 2001 From: p4p1 Date: Sat, 16 Mar 2024 23:41:55 +0100 Subject: [PATCH] Fixed untrusted data parsing to prevent XSS, it is a quick fix but it works --- public/app.html | 87 +++++++++++++++++++++++++------------------------ 1 file changed, 44 insertions(+), 43 deletions(-) diff --git a/public/app.html b/public/app.html index d59a38ca..9602cce9 100755 --- a/public/app.html +++ b/public/app.html @@ -17,6 +17,7 @@ + @@ -1247,9 +1248,9 @@ site.extracted.forEach((extracted, i) => { let temp_extracted = ''; Object.keys(extracted).forEach((key) => { - temp_extracted += `${key} : ${extracted[key]} `; + temp_extracted += `${DOMPurify.sanitize(key, { USE_PROFILES: { html: false } })} : ${DOMPurify.sanitize(extracted[key], { USE_PROFILES: { html: false } })} `; }); - temp_extracted_all += `
Extracted ${i}: ${temp_extracted}
`; + temp_extracted_all += `
Extracted ${DOMPurify.sanitize(i, { USE_PROFILES: { html: false } })}: ${temp_extracted}
`; }); } } catch (err) { @@ -1261,9 +1262,9 @@ site.metadata.forEach((extracted, i) => { let temp_metadata = ''; Object.keys(extracted).forEach((key) => { - temp_metadata += `${key} : ${extracted[key]} `; + temp_metadata += `${DOMPurify.sanitize(key, { USE_PROFILES: { html: false } })} : ${DOMPurify.sanitize(extracted[key])} `; }); - temp_metadata_all += `
Metadata ${i}: ${temp_metadata}
`; + temp_metadata_all += `
Metadata ${DOMPurify.sanitize(i, { USE_PROFILES: { html: false } })}: ${temp_metadata}
`; }); } } catch (err) { @@ -1279,12 +1280,12 @@ Object.keys(items).forEach((key) => { if (items[key].length > 0) { - temp_th += `${key}`; + temp_th += `${DOMPurify.sanitize(key, { USE_PROFILES: { html: false } })}`; let temp_ul = ''; items[key].forEach((item) => { - temp_ul += `
  • ${item}
    • `; + temp_ul += `
  • ${DOMPurify.sanitize(item, { USE_PROFILES: { html: false } })}
    • `; }); - temp_td += ``; + temp_td += ``; } }); @@ -1323,7 +1324,7 @@ if (data.common.length > 0) { temp_tr = ''; Object.keys(data.common).forEach((item) => { - temp_tr += `${data.common[item].word}${data.common[item].languages}`; + temp_tr += `${DOMPurify.sanitize(data.common[item].word, { USE_PROFILES: { html: false } })}${DOMPurify.sanitize(data.common[item].languages, { USE_PROFILES: { html: false } })}`; }); $('#most-common-words-table').last().append(`${temp_tr}
    wordlanguages
    `); @@ -1334,7 +1335,7 @@ if (data.info.items.length > 0) { temp_tr = ''; Object.keys(data.info.items).forEach((item) => { - temp_tr += `${data.info.items[item].title}${data.info.items[item].snippet}`; + temp_tr += `${DOMPurify.sanitize(data.info.items[item].title, { USE_PROFILES: { html: false } })}${DOMPurify.sanitize(data.info.items[item].snippet, { USE_PROFILES: { html: false } })}`; }); $('#lookups-table').last().append(`${temp_tr}
    titlesnippet
    `); $('#lookups-table').show(); @@ -1344,10 +1345,10 @@ } if (data.words_info.length > 0) { data.words_info.forEach((item) => { - temp_tr = `${item.word}definition${item.text}`; + temp_tr = `${DOMPurify.sanitize(item.word, { USE_PROFILES: { html: false } })}definition${DOMPurify.sanitize(item.text, { USE_PROFILES: { html: false } })}`; if (item.results.length > 0) { item.results.forEach((result) => { - temp_tr += `${item.word}${result.type}${result.text}`; + temp_tr += `${DOMPurify.sanitize(item.word, { USE_PROFILES: { html: false } })}${DOMPurify.sanitize(result.type, { USE_PROFILES: { html: false } })}${DOMPurify.sanitize(result.text, { USE_PROFILES: { html: false } })}`; }); } $('#words-info-tables').last().append(`${temp_tr}
    wordtypetext
    `); @@ -1364,12 +1365,12 @@ if (site.found > 0 || site.image !== '') { let temp_image = ''; if (site.image !== '') { - temp_image = ``; + temp_image = ``; } const temp_extract_adv = add_extract(site); - temp_tr += `