修复 Markdown 预览、文本对比与正则结果中的 XSS - #17
Draft
cursor[bot] wants to merge 1 commit into
Draft
Conversation
renderMD, textDiff, and regex test output injected unsanitized user input into innerHTML, allowing script execution from crafted text. Co-authored-by: Muki182 <Muki182@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
问题与影响
在单页
index.html中，Markdown 预览、文本对比与正则测试结果将用户输入直接拼进innerHTML。攻击者可构造包含<script>或事件属性的文本，在同一来源下执行脚本，属于客户端 XSS（钓鱼、篡改页面等）。根因
未对用户可控字符串做 HTML 转义即写入
innerHTML。修复
escapeHtml()，对&、"、'、<、>进行实体转义。renderMD()：先对整段 Markdown 源码转义，再应用原有简易语法替换。textDiff()：对每行展示内容转义后再插入模板。testRegex()：对匹配子串与异常信息转义后再写入 DOM。验证
对
innerHTML写入路径做了代码审查；仓库内无既有自动化测试框架，未新增测试文件。GitHub Pages 部署使用的upload-pages-artifact会排除.git/.github，部署工作流未发现需改动的严重问题。