IntenseWebs/discourse
3
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-02-25 18:55:32 -06:00
Code Issues Packages Projects Releases Wiki Activity

SECURITY: Backported XSS fixes from Handlebars

Browse Source
This commit is contained in:
Robin Ward
2015-11-24 16:07:47 -05:00
parent f4d44187c8
commit 434deb1bd3
22 changed files with 70 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
vendor/assets/javascripts/handlebars.js vendored
View File

@@ -64,11 +64,16 @@ var __module3__ = (function(__dependency1__) {
">": ">",
'"': """,
"'": "'",
"`": "`"
'`': '`',
'\n' : '\\n', // NewLine
'\r' : '\\n', // Return
'\b' : '\\b', // Backspace
'\f' : '\\f', // Form fee
'\t' : '\\t', // Tab
'\v' : '\\v' // Vertical Tab
};
var badChars = /[&<>"'`]/g;
var possible = /[&<>"'`]/;
var badChars = /[&<>"'`\b\f\n\r\t\v]/g;
var possible = /[&<>"'`\b\f\n\r\t\v]/;
function escapeChar(chr) {
return escape[chr];