From 6b9462f6065b24b6a721140da0d80c66d177d4b6 Mon Sep 17 00:00:00 2001 From: Knut Sveidqvist Date: Sun, 27 Jun 2021 00:24:19 +0200 Subject: [PATCH] Preventing xss manipulation using onerror with the antiscript setting. --- cypress/integration/other/xss.spec.js | 5 ++ cypress/platform/xss6.html | 97 +++++++++++++++++++++++++++ src/diagrams/common/common.js | 5 +- 3 files changed, 105 insertions(+), 2 deletions(-) create mode 100644 cypress/platform/xss6.html diff --git a/cypress/integration/other/xss.spec.js b/cypress/integration/other/xss.spec.js index 842eab36f..fb052d171 100644 --- a/cypress/integration/other/xss.spec.js +++ b/cypress/integration/other/xss.spec.js @@ -63,5 +63,10 @@ describe('XSS', () => { cy.wait(1000); cy.get('#the-malware').should('not.exist'); }) + it('should not allow maniplulating antiscript to run javascript using onerror', () => { + cy.visit('http://localhost:9000/xss6.html'); + cy.wait(1000); + cy.get('#the-malware').should('not.exist'); + }) }) diff --git a/cypress/platform/xss6.html b/cypress/platform/xss6.html new file mode 100644 index 000000000..dcc9f8652 --- /dev/null +++ b/cypress/platform/xss6.html @@ -0,0 +1,97 @@ + + + + + + + + + +
Security check
+
+
+
+ + + + + diff --git a/src/diagrams/common/common.js b/src/diagrams/common/common.js index 885f350de..0de97b269 100644 --- a/src/diagrams/common/common.js +++ b/src/diagrams/common/common.js @@ -27,8 +27,9 @@ export const removeScript = txt => { } } - rs = rs.replace('javascript:', '#'); - rs = rs.replace('