dab/AJM_digitalmethods_course
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge pull request #3548 from hackmdio/fix/xss-on-data-background-video-attribute

Browse source 
fix: use `setAttribute` instead of `innerHTML` to prevent XSS
This commit is contained in:
Hakim El Hattab 2023-12-15 08:56:55 +01:00 committed by GitHub
commit 767a67ee00
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 6 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
js/controllers/slidecontent.js
View file

@ -142,13 +142,15 @@ export default class SlideContent {
// Support comma separated lists of video sources // Support comma separated lists of video sources
backgroundVideo.split( ',' ).forEach( source => { backgroundVideo.split( ',' ).forEach( source => {
const sourceElement = document.createElement( 'source' );
sourceElement.setAttribute( 'src', source );
let type = getMimeTypeFromFile( source ); let type = getMimeTypeFromFile( source );
if( type ) { if( type ) {
video.innerHTML += `<source src="${source}" type="${type}">`; sourceElement.setAttribute( 'type', type );
}
else {
video.innerHTML += `<source src="${source}">`;
} }
video.appendChild( sourceElement );
} ); } );
backgroundContent.appendChild( video ); backgroundContent.appendChild( video );