Andreas/wekan
1
0
Fork 0
mirror of https://github.com/wekan/wekan.git synced 2025-12-16 23:40:13 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 5

Try to fix some security issues.

Browse source 
Thanks to responsible security disclosure contributors and xet7 !
This commit is contained in:
Lauri Ojansivu 2023-02-20 01:21:33 +02:00
parent b349ecbdf7
commit ff993e7c91
9 changed files with 4272 additions and 2291 deletions
Download patch file Download diff file Expand all files Collapse all files

8
client/components/cards/attachments.js
View file

@ -1,4 +1,5 @@
import { ObjectID } from 'bson';
import DOMPurify from 'isomorphic-dompurify';
const filesize = require('filesize');
const prettyMilliseconds = require('pretty-ms');
@ -21,6 +22,9 @@ Template.attachmentsGalery.helpers({
const ret = filesize(size);
return ret;
},
sanitize(value) {
return DOMPurify.sanitize(value);
},
});
Template.cardAttachmentsPopup.onCreated(function() {
@ -49,6 +53,10 @@ Template.cardAttachmentsPopup.events({
let uploads = [];
for (const file of files) {
const fileId = new ObjectID().toString();
// If filename is not same as sanitized filename, has XSS, then cancel upload
if (file.name !== DOMPurify.sanitize(file.name)) {
return false;
}
const config = {
file: file,
fileId: fileId,