pt
/
superset
mirror of https://github.com/apache/superset.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

fix(dashboard): Prevent XSS attack vector (#21822) 

Co-authored-by: Herbert Gainor <herbert.gainor@preset.io>
This commit is contained in:
Anthony Gainor 2022-10-19 06:54:20 -06:00 committed by GitHub
parent 7c4102c20e
commit ec20c0104e
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
superset-frontend/packages/superset-ui-core/src/components/SafeMarkdown.tsx
View File

@ -30,7 +30,7 @@ interface SafeMarkdownProps {
function isSafeMarkup(node: MarkdownAbstractSyntaxTree) {
return node.type === 'html' && node.value
? /href="(javascript|vbscript|file):.*"/gim.test(node.value) === false
? !/(href|src)="(javascript|vbscript|file):.*"/gim.test(node.value)
: true;
}