jan/openreplay
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(player): sanitize html nodes

Browse source
This commit is contained in:
sylenien 2022-09-01 10:16:08 +02:00
parent 32757d62cd
commit 13b589dcb9
1 changed files with 14 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
frontend/app/player/MessageDistributor/StatedScreen/Screen/Marker.js
View file

@ -1,5 +1,17 @@
import styles from './marker.module.css';
function escapeRegExp(string) {
return string.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
}
function escapeHtml(string) {
return string.replaceAll('&', '&amp;').replaceAll('<', '&lt;').replaceAll('>', '&gt;').replaceAll('"', '&quot;').replaceAll("'", '&#039;');
}
function safeString(string) {
return (escapeHtml(escapeRegExp(string)))
}
export default class Marker {
_target = null;
_selector = null;
@ -92,11 +104,11 @@ export default class Marker {
let k = attrs[i];
const attribute = k.name;
if (attribute === 'class') {
str += `<span style="color:#F29766">${'.' + k.value.split(' ').join('.')}</span>`;
str += `<span style="color:#F29766">${'.' + safeString(k.value.split(' ').join('.'))}</span>`;
}
if (attribute === 'id') {
str += `<span style="color:#F29766">${'#' + k.value.split(' ').join('#')}</span>`;
str += `<span style="color:#F29766">${'#' + safeString(k.value.split(' ').join('#'))}</span>`;
}
}