Преглед изворни кода

Add warning to beginning of sanitized filename.

Thanks to xet7!

Related https://github.com/wekan/wekan/pull/5083
Lauri Ojansivu пре 1 година
родитељ
комит
28e97808f5
1 измењених фајлова са 5 додато и 2 уклоњено
  1. 5 2
      client/components/cards/attachments.js

+ 5 - 2
client/components/cards/attachments.js

@@ -292,10 +292,13 @@ Template.cardAttachmentsPopup.events({
       let uploads = [];
       let uploads = [];
       for (const file of files) {
       for (const file of files) {
         const fileId = new ObjectID().toString();
         const fileId = new ObjectID().toString();
-        const fileName = DOMPurify.sanitize(file.name);
+        const warning = "WARNING-XSS-SANITIZED-";
+        let fileName = DOMPurify.sanitize(file.name);
 
 
         if (fileName !== file.name) {
         if (fileName !== file.name) {
-          console.warn('Detected possible XSS in file: ', file.name + '. Renamed to: ', fileName + '.');
+          // console.warn('Detected possible XSS in file: ', file.name + '. Renamed to: ', fileName + '.');
+          // Add warning about XSS sanitized:
+          fileName = warning.concat(fileName);
         }
         }
 
 
         const config = {
         const config = {