Skip to content

Commit 6da3425

Browse files
committed
fix: xss issue
1 parent 35e71de commit 6da3425

File tree

1 file changed

+6
-1
lines changed

1 file changed

+6
-1
lines changed

src/components/common/MarkdownRender.tsx

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,10 @@ export interface MarkdownRenderProps {
3030
editing?: boolean;
3131
}
3232

33+
function sanitizeEventScript(htmlString: string) {
34+
return htmlString.replace(/ on\w+="[^"]*"/g, '');
35+
}
36+
3337
const MarkdownRenderBlock = styled.div`
3438
&.atom-one {
3539
${prismThemes['atom-one']}
@@ -123,7 +127,8 @@ const MarkdownRenderBlock = styled.div`
123127
`;
124128

125129
function filter(html: string) {
126-
return sanitize(html, {
130+
const presanitized = sanitizeEventScript(html);
131+
return sanitize(presanitized, {
127132
allowedTags: [
128133
'h1',
129134
'h2',

0 commit comments

Comments
 (0)