Эх сурвалжийг харах

HUE-7538 [frontend] Override default knockout html binding to prevent XSS

Enrico Berti 8 жил өмнө
parent
commit
bbef487

+ 17 - 0
desktop/core/src/desktop/static/desktop/js/ko.hue-bindings.js

@@ -69,6 +69,23 @@
     return result;
   };
 
+  // we override the default html binding to prevent XSS/JS injection
+  var originalHtmlBinding = ko.bindingHandlers.html;
+  ko.bindingHandlers.html = {
+    init: function (element, valueAccessor, allBindings, viewModel, bindingContext) {
+      var newValueAccessor = function () {
+        return hueUtils.deXSS(ko.unwrap(valueAccessor()));
+      };
+      originalHtmlBinding.init(element, newValueAccessor, allBindings, viewModel, bindingContext);
+    },
+    update: function (element, valueAccessor, allBindings, viewModel, bindingContext) {
+      var newValueAccessor = function () {
+        return hueUtils.deXSS(ko.unwrap(valueAccessor()));
+      };
+      originalHtmlBinding.update(element, newValueAccessor, allBindings, viewModel, bindingContext);
+    },
+  };
+
   ko.observableDefault = function () {
     var prop = arguments[0], defvalue = arguments[1] || null;
     return ko.observable(typeof prop != "undefined" && prop != null ? prop : defvalue);