Paths

Table of Contentst

Differential D1412

assets/readme-rendering: Use dompurify as XSS filter
ClosedPublic
Actions

Authored by anlambert on Apr 12 2019, 2:52 PM.

Tags

None

Subscribers

Details

Reviewers

Group Reviewers

Commits

rDWAPPS6cbad0ef83c3: assets/readme-rendering: Use dompurify as XSS filter instead of xss

Summary

XSS filtering has recently been added to swh-web (D1322) for the rendering
of README files in markdown format.

But as @kalpitk noticed it, the rendering of images located in an origin source tree
is now broken.

So instead of using [[ https://github.com/VisionistInc/showdown-xss-filter | showdown-xss-filter ]] package, prefer to use the [[ https://github.com/cure53/DOMPurify | dompurify ]]
one which seems to have a good default white list for XSS filtering.

Related T1642

Diff Detail

Repository

rDWAPPS Web applications

Lint

Automatic diff as part of commit; lint not applicable.

Unit

Automatic diff as part of commit; unit tests not applicable.

Event Timeline

anlambert created this revision.Apr 12 2019, 2:52 PM

Herald added a reviewer: Reviewers. · View Herald TranscriptApr 12 2019, 2:52 PM

anlambert mentioned this in T1642: Images with src within repo dont render in Readme.Apr 12 2019, 2:53 PM

Build is green
See https://jenkins.softwareheritage.org/job/DWAPPS/job/tox/383/ for more details.

Harbormaster completed remote builds in B5400: Diff 4549.Apr 12 2019, 2:55 PM

Update: Simplify code and add XSS filtering for all supported README types

anlambert edited the summary of this revision. (Show Details)Apr 12 2019, 3:07 PM

Build is green
See https://jenkins.softwareheritage.org/job/DWAPPS/job/tox/386/ for more details.

Harbormaster completed remote builds in B5401: Diff 4550.Apr 12 2019, 3:10 PM

ardumont accepted this revision.Apr 13 2019, 11:01 AM

This revision is now accepted and ready to land.Apr 13 2019, 11:01 AM

Rebase

Build is green
See https://jenkins.softwareheritage.org/job/DWAPPS/job/tox/388/ for more details.

Harbormaster completed remote builds in B5433: Diff 4571.Apr 15 2019, 10:45 AM

Closed by commit rDWAPPS6cbad0ef83c3: assets/readme-rendering: Use dompurify as XSS filter instead of xss (authored by anlambert). · Explain WhyApr 15 2019, 10:45 AM

This revision was automatically updated to reflect the committed changes.

Revision Contents
Changeset List

Path

Size

2 lines

swh/

web/

assets/

src/

bundles/

webapp/

readme-rendering.js

24 lines

templates/

includes/

readme-display.html

2 lines

27 lines

Diff 4572

package.json

Loading...

swh/web/assets/src/bundles/webapp/readme-rendering.js

Loading...

swh/web/templates/includes/readme-display.html

Loading...

yarn.lock

Loading...