clone/logseq
1
0
Fork 0
mirror of https://github.com/logseq/logseq.git synced 2026-04-24 22:25:01 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(plugins): avoid xss for the injected readme html content

Browse Source
This commit is contained in:
charlie
2025-04-25 12:28:59 +08:00
parent 5efaf84507
commit 4cdf49aedd
3 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
gulpfile.js
View File

@@ -72,6 +72,7 @@ const common = {
'node_modules/react-dom/umd/react-dom.production.min.js', 'node_modules/react-dom/umd/react-dom.production.min.js',
'node_modules/react-dom/umd/react-dom.development.js', 'node_modules/react-dom/umd/react-dom.development.js',
'node_modules/prop-types/prop-types.min.js', 'node_modules/prop-types/prop-types.min.js',
'node_modules/dompurify/dist/purify.js',
]).pipe(gulp.dest(path.join(outputPath, 'js'))), ]).pipe(gulp.dest(path.join(outputPath, 'js'))),
() => gulp.src([ () => gulp.src([
'node_modules/@tabler/icons-react/dist/umd/tabler-icons-react.min.js', 'node_modules/@tabler/icons-react/dist/umd/tabler-icons-react.min.js',

3
resources/marketplace.html
View File

@@ -69,6 +69,7 @@
<body> <body>
<div id="app"></div> <div id="app"></div>
<script src="./js/marked.min.js"></script> <script src="./js/marked.min.js"></script>
<script src="./js/purify.js"></script>
<script> <script>
;(async function () { ;(async function () {
const app = document.getElementById('app') const app = document.getElementById('app')
@@ -131,7 +132,7 @@
} }
content = marked.parse(content).replace('src="./', `src="${fixLink('')}`) content = marked.parse(content).replace('src="./', `src="${fixLink('')}`)
setContent(content) setContent(DOMPurify.sanitize(content))
} }
// load default // load default

2
src/main/frontend/components/plugins.cljs
View File

@@ -202,7 +202,7 @@
(rum/defc remote-readme-display (rum/defc remote-readme-display
[{:keys [repo]} _content] [{:keys [repo]} _content]
(let [src (str (if (string/includes? js/location.href "logseq") (let [src (str (if (string/includes? js/location.host "logseq")
"./static/" "./") "marketplace.html?repo=" repo)] "./static/" "./") "marketplace.html?repo=" repo)]
[:iframe.lsp-frame-readme {:src src}])) [:iframe.lsp-frame-readme {:src src}]))