diff options
Diffstat (limited to 'modules/ext/floating.js')
| -rw-r--r-- | modules/ext/floating.js | 13 |
1 files changed, 9 insertions, 4 deletions
diff --git a/modules/ext/floating.js b/modules/ext/floating.js index 4c332fc..ef266da 100644 --- a/modules/ext/floating.js +++ b/modules/ext/floating.js @@ -198,7 +198,8 @@ class FloatingModule { _renderButton(el) { const btn = document.createElement('button'); btn.className = 'floating-btn'; - btn.innerHTML = el.label; + // v4.5.67: Use textContent to prevent XSS from saved floating elements + btn.textContent = el.label || ''; btn.onclick = (e) => { e.stopPropagation(); if (el.command && this.terminal) { @@ -214,7 +215,8 @@ class FloatingModule { const header = document.createElement('div'); header.className = 'floating-menu-header'; - header.innerHTML = `<span class="arrow ${el.collapsed ? 'collapsed' : ''}">▼</span> ${el.label}`; + // v4.5.67: Sanitize label — use escaped text to prevent XSS + header.innerHTML = `<span class="arrow ${el.collapsed ? 'collapsed' : ''}">▼</span> ${this._escapeHtml(el.label || '')}`; const body = document.createElement('div'); body.className = 'floating-menu-body' + (el.collapsed ? '' : ' expanded'); @@ -266,8 +268,11 @@ class FloatingModule { html = html.replace(/\*(.+?)\*/g, '<em>$1</em>'); // `code` html = html.replace(/`([^`]+)`/g, '<code>$1</code>'); - // [text](url) - html = html.replace(/\[([^\]]+)\]\(([^)]+)\)/g, '<a href="$2" target="_blank" rel="noopener">$1</a>'); + // [text](url) — v4.5.67: sanitize URL to prevent javascript: scheme + html = html.replace(/\[([^\]]+)\]\(([^)]+)\)/g, (match, text, url) => { + const safeUrl = /^(https?:\/\/|mailto:|\/|#)/.test(url) ? url : '#'; + return `<a href="${safeUrl}" target="_blank" rel="noopener">${text}</a>`; + }); // newlines to <br> html = html.replace(/\n/g, '<br>'); return html; |