angryzero/rust-rcon
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Should fix XSS mentioned in #32

Browse Source
This commit is contained in:
Garry Newman
2021-02-20 11:37:58 +00:00
parent 757dc3bd95
commit 3d8b4e0fea
2 changed files with 6 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
js/chat.js
+4 -5
View File
@@ -21,6 +21,8 @@ function ChatController( $scope, rconService, $timeout )
$scope.OnMessage = function( msg ) $scope.OnMessage = function( msg )
{ {
msg.Message = stripHtml(msg.Message); msg.Message = stripHtml(msg.Message);
msg.Username = stripHtml(msg.Username);
$scope.Output.push( msg ); $scope.Output.push( msg );
if($scope.isOnBottom()) { if($scope.isOnBottom()) {
@@ -79,10 +81,7 @@ function ChatController( $scope, rconService, $timeout )
rconService.InstallService( $scope, $scope.GetHistory ) rconService.InstallService( $scope, $scope.GetHistory )
} }
function stripHtml(html) function stripHtml( text )
{ {
if (html == null) return ""; return text ? String(text).replace( /<[^>]+>/gm, '' ) : '';
var tmp = document.createElement("div");
tmp.innerHTML = html;
return tmp.textContent || tmp.innerText || "";
} }
js/console.js
+2
View File
@@ -134,6 +134,8 @@ function ConsoleController( $scope, rconService, $timeout )
$scope.addOutput = function (msg) $scope.addOutput = function (msg)
{ {
msg.Class = msg.Type; msg.Class = msg.Type;
msg.Message = stripHtml(msg.Message);
$scope.Output.push( msg ); $scope.Output.push( msg );
if($scope.isOnBottom()) { if($scope.isOnBottom()) {