From 39ef19f8c98fb22660a7deacedcc3c45a63b1948 Mon Sep 17 00:00:00 2001 From: Innei Date: Wed, 19 Apr 2023 09:46:17 +0800 Subject: [PATCH] fix: xss (#384) --- package.json | 1 + pnpm-lock.yaml | 16 ++++++++++++++++ src/components/common/CharacterCard.tsx | 3 ++- src/components/common/PatronModal.tsx | 3 ++- src/components/site/SiteHeader.tsx | 5 ++++- src/components/ui/Mermaid.tsx | 3 ++- .../dashboard/[subdomain]/settings/general.tsx | 3 ++- 7 files changed, 29 insertions(+), 5 deletions(-) diff --git a/package.json b/package.json index f141f18e..4ec70c93 100644 --- a/package.json +++ b/package.json @@ -137,6 +137,7 @@ "use-onclickoutside": "0.4.1", "uuid": "9.0.0", "wagmi": "0.12.10", + "xss": "1.0.14", "zustand": "^4.3.7" }, "devDependencies": { diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 76ed1ab5..1dbc8d05 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -325,6 +325,9 @@ dependencies: wagmi: specifier: 0.12.10 version: 0.12.10(@babel/core@7.21.4)(@types/node@18.15.11)(ethers@5.7.2)(immer@9.0.21)(react-dom@18.2.0)(react@18.2.0)(typescript@5.0.4) + xss: + specifier: 1.0.14 + version: 1.0.14 zustand: specifier: ^4.3.7 version: 4.3.7(immer@9.0.21)(react@18.2.0) @@ -7052,6 +7055,10 @@ packages: engines: {node: '>=4'} hasBin: true + /cssfilter@0.0.10: + resolution: {integrity: sha512-FAaLDaplstoRsDR8XGYH51znUN0UY7nMc6Z9/fvE8EXGwvJE9hu7W2vHwx1+bd6gCYnln9nLbzxFTrcO9YQDZw==} + dev: false + /csstype@3.0.9: resolution: {integrity: sha512-rpw6JPxK6Rfg1zLOYCSwle2GFOOsnjmDYDaBwEcwoOg4qlsIVCN789VkBZDJAGi4T07gI4YSutR43t9Zz4Lzuw==} dev: false @@ -14806,6 +14813,15 @@ packages: engines: {node: '>=8.0'} dev: false + /xss@1.0.14: + resolution: {integrity: sha512-og7TEJhXvn1a7kzZGQ7ETjdQVS2UfZyTlsEdDOqvQF7GoxNfY+0YLCzBy1kPdsDDx4QuNAonQPddpsn6Xl/7sw==} + engines: {node: '>= 0.10.0'} + hasBin: true + dependencies: + commander: 2.20.3 + cssfilter: 0.0.10 + dev: false + /xtend@4.0.2: resolution: {integrity: sha512-LKYU1iAXJXUgAXn9URjiu+MWhyUXHsvfp7mcuYm9dSUKK0/CjtrUwFAxD82/mCWbtLsGjFIad0wIsod4zrTAEQ==} engines: {node: '>=0.4'} diff --git a/src/components/common/CharacterCard.tsx b/src/components/common/CharacterCard.tsx index 903c8b5a..46da3c34 100644 --- a/src/components/common/CharacterCard.tsx +++ b/src/components/common/CharacterCard.tsx @@ -1,5 +1,6 @@ import { useTranslation } from "next-i18next" import { useEffect, useState } from "react" +import xss from "xss" import { FollowingButton } from "~/components/common/FollowingButton" import { FollowingCount } from "~/components/common/FollowingCount" @@ -83,7 +84,7 @@ export const CharacterCard: React.FC<{ {site?.description && ( )} {!simple && ( diff --git a/src/components/common/PatronModal.tsx b/src/components/common/PatronModal.tsx index 54f03cb9..960be060 100644 --- a/src/components/common/PatronModal.tsx +++ b/src/components/common/PatronModal.tsx @@ -2,6 +2,7 @@ import confetti from "canvas-confetti" import { useTranslation } from "next-i18next" import { useEffect, useRef, useState } from "react" import { toast } from "react-hot-toast" +import xss from "xss" import { useAccountState, useConnectModal } from "@crossbell/connect-kit" @@ -146,7 +147,7 @@ export const PatronModal: React.FC<{ {site?.description && ( )} diff --git a/src/components/site/SiteHeader.tsx b/src/components/site/SiteHeader.tsx index 1c893499..cc4eb77e 100644 --- a/src/components/site/SiteHeader.tsx +++ b/src/components/site/SiteHeader.tsx @@ -3,6 +3,7 @@ import { FastAverageColor } from "fast-average-color" import { useTranslation } from "next-i18next" import { useRouter } from "next/router" import { MutableRefObject, RefObject, useEffect, useRef, useState } from "react" +import xss from "xss" import { XCharLogo, XFeedLogo } from "@crossbell/ui" import { RssIcon } from "@heroicons/react/24/solid" @@ -321,7 +322,9 @@ export const SiteHeader: React.FC<{ {site?.bio && (
)}
diff --git a/src/components/ui/Mermaid.tsx b/src/components/ui/Mermaid.tsx index 8c7a85b8..b6087348 100644 --- a/src/components/ui/Mermaid.tsx +++ b/src/components/ui/Mermaid.tsx @@ -1,5 +1,6 @@ import { nanoid } from "nanoid" import { FC, useEffect, useState } from "react" +import xss from "xss" import { useIsDark } from "~/hooks/useDarkMode" import { useIsUnmounted } from "~/hooks/useLifecycle" @@ -57,7 +58,7 @@ export const Mermaid: FC<{ Mermaid Loading...
) : svg ? ( -
+
) : (
{error || "Error"} diff --git a/src/pages/dashboard/[subdomain]/settings/general.tsx b/src/pages/dashboard/[subdomain]/settings/general.tsx index 9b72d4d5..e13547c5 100644 --- a/src/pages/dashboard/[subdomain]/settings/general.tsx +++ b/src/pages/dashboard/[subdomain]/settings/general.tsx @@ -5,6 +5,7 @@ import { useEffect, useState } from "react" import type { ReactElement } from "react" import { Controller, useForm } from "react-hook-form" import toast from "react-hot-toast" +import xss from "xss" import { DashboardLayout } from "~/components/dashboard/DashboardLayout" import { getServerSideProps as getLayoutServerSideProps } from "~/components/dashboard/DashboardLayout.server" @@ -63,7 +64,7 @@ export default function SiteSettingsGeneralPage() { banner: values.banner, site: subdomain, name: values.name, - description: values.description, + description: xss(values.description), ga: values.ga, }) })