Hotfix XSS vulnerability due to failed sanitization

This commit is contained in:
Stefan Zermatten
2023-08-14 09:55:45 +02:00
parent d9e0679734
commit 686a85c768
2 changed files with 2 additions and 2 deletions

View File

@@ -9,6 +9,7 @@
<script lang="js">
import { marked } from 'marked';
import DOMPurify from 'dompurify';
export default {
props: {
@@ -20,7 +21,7 @@ export default {
computed: {
compiledMarkdown() {
if (!this.markdown) return;
return marked(this.markdown);
return DOMPurify.sanitize(marked(this.markdown));
},
},
}

View File

@@ -4,7 +4,6 @@ import DOMPurify from 'dompurify';
marked.setOptions({
breaks: true,
gfm: true,
sanitizer: DOMPurify.sanitize,
silent: true,
smartLists: true,
smartypants: true,