Should fix XSS mentioned in #32

2021-02-20 11:37:58 +00:00
parent 757dc3bd95
commit 3d8b4e0fea
2 changed files with 6 additions and 5 deletions
@@ -21,6 +21,8 @@ function ChatController( $scope, rconService, $timeout )
 	$scope.OnMessage = function( msg )
 	{
 		msg.Message = stripHtml(msg.Message);
+		msg.Username = stripHtml(msg.Username);
+		
 		$scope.Output.push( msg );
 		
 		if($scope.isOnBottom()) {
@@ -79,10 +81,7 @@ function ChatController( $scope, rconService, $timeout )
 	rconService.InstallService( $scope, $scope.GetHistory )
 }

-function stripHtml(html)
+function stripHtml( text )
 {
-	if (html == null) return "";
-	var tmp = document.createElement("div");
-	tmp.innerHTML = html;
-	return tmp.textContent || tmp.innerText || "";
+	return text ? String(text).replace( /<[^>]+>/gm, '' ) : '';
 }
@@ -134,6 +134,8 @@ function ConsoleController( $scope, rconService, $timeout )
 	$scope.addOutput = function (msg)
 	{
 		msg.Class = msg.Type;
+		msg.Message = stripHtml(msg.Message);
+
 		$scope.Output.push( msg );

 		if($scope.isOnBottom()) {