IntenseWebs/PeerTube
3
0
Fork 0
mirror of https://github.com/Chocobozzz/PeerTube.git synced 2026-09-03 20:53:09 -05:00
Code Issues Packages Projects Releases Wiki Activity

Escape config when injecting it in HTML

Browse Source
This commit is contained in:
Chocobozzz
2026-07-01 13:25:01 +02:00
parent 6d6a60165b
commit 45394d701b
2 changed files with 28 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/tests/src/client/index-html.ts
+17
View File
@@ -80,6 +80,18 @@ describe('Test index HTML generation', function () {
checkIndexTags(res.text, 'PeerTube updated', 'my short description', 'body { background-color: red; }', config)
})
it('Should escape HTML characters in the index html tags', async function () {
await servers[0].config.updateExistingConfig({
newConfig: {
instance: {
name: '</script><img src=x onerror=alert(1)>'
}
}
})
const res = await makeHTMLRequest(servers[0].url, '/videos/browse')
expect(res.text).to.contain('\\u003c/script\\u003e\\u003cimg src=x onerror=alert(1)\\u003e')
})
})
describe('Canonical tags', function () {
@@ -120,6 +132,11 @@ describe('Test index HTML generation', function () {
channelURLtests(await makeHTMLRequest(servers[0].url, '/c/root_channel@' + servers[0].host))
channelURLtests(await makeHTMLRequest(servers[0].url, '/@root_channel@' + servers[0].host))
})
it('Should escape canonical tag URL', async function () {
const res = await makeHTMLRequest(servers[0].url, '/watch/foo"><svg/onload=alert(1)>')
expect(res.text).to.not.contain('<svg/onload=alert(1)>')
})
})
describe('Indexation tags', function () {
server/core/lib/html/shared/page-html.ts
+11 -2
View File
@@ -1,4 +1,11 @@
import { AVAILABLE_LOCALES, buildFileLocale, escapeHTML, getDefaultLocale, is18nLocale } from '@peertube/peertube-core-utils'
import {
AVAILABLE_LOCALES,
buildFileLocale,
escapeHTML,
escapeHtmlJSONStr,
getDefaultLocale,
is18nLocale
} from '@peertube/peertube-core-utils'
import { HTMLServerConfig } from '@peertube/peertube-models'
import { isTestOrDevInstance, root, sha256 } from '@peertube/peertube-node-utils'
import { setClientLanguageCookie } from '@server/helpers/i18n.js'
@@ -147,7 +154,9 @@ export class PageHtml {
static addServerConfig (htmlStringPage: string, serverConfig: HTMLServerConfig) {
// Stringify the JSON object, and then stringify the string object so we can inject it into the HTML
const serverConfigString = JSON.stringify(JSON.stringify(serverConfig))
const configScriptTag = `<script type="application/javascript">window.PeerTubeServerConfig = ${serverConfigString}</script>`
const configScriptTag = `<script type="application/javascript">` +
`window.PeerTubeServerConfig = ${escapeHtmlJSONStr(serverConfigString)}` +
`</script>`
return htmlStringPage.replace(CUSTOM_HTML_TAG_COMMENTS.SERVER_CONFIG, configScriptTag)
}