fix: 修复 Markdown / 文本对比 / 正则结果中的 XSS - #16
Draft
cursor[bot] wants to merge 1 commit into
Draft
cursor[bot] wants to merge 1 commit into
cursor[bot] wants to merge 1 commit into
Conversation
Escape user-controlled strings before assigning to innerHTML in renderMD, textDiff, and testRegex so pasted HTML cannot execute as script. Co-authored-by: Muki182 <Muki182@users.noreply.github.com>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
问题与影响
单页工具箱中多处将用户输入直接写入
innerHTML。攻击者可诱导用户在「Markdown 预览」「文本对比」或「正则测试」中粘贴恶意 HTML/脚本，从而在受害者浏览器中执行任意 JavaScript（窃取本页上下文中的敏感操作、钓鱼等）。根因
renderMD()：未对 Markdown 原文做 HTML 转义，原始标签会进入 DOM。textDiff()：对比行内容直接拼进 HTML 字符串。testRegex()：匹配子串与部分错误信息直接拼进 HTML。修复
新增
escapeHtml()，在上述路径对用户可见内容转义后再写入innerHTML。验证
actions/upload-pages-artifact会排除.git/.github，部署工作流不构成元数据泄露问题。