self-hosted/joplin
1
0
Fork 0
mirror of https://github.com/laurent22/joplin.git synced 2025-06-15 23:00:36 +02:00
Code Issues Releases Activity

Electron: Resolves #500: Fixed XSS security vulnerability

Browse Source
This commit is contained in:
Laurent Cozic
2018-05-09 16:59:33 +01:00
parent 85219a6004
commit 494e235e18
3 changed files with 17 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
ReactNativeClient/lib/MdToHtml.js
View File

@ -389,7 +389,7 @@ class MdToHtml {
const md = new MarkdownIt({
breaks: true,
linkify: true,
html: true,
html: false, // For security, HTML tags are not supported - https://github.com/laurent22/joplin/issues/500
});
// This is currently used only so that the $expression$ and $$\nexpression\n$$ blocks are translated
@ -435,6 +435,9 @@ class MdToHtml {
}
}
// Support <br> tag to allow newlines inside table cells
renderedBody = renderedBody.replace(/&lt;br&gt;/gi, '<br>');
// https://necolas.github.io/normalize.css/
const normalizeCss = `
html{line-height:1.15;-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}body{margin:0}