Fix to escape html comment tag [Security Issue]

jackycute · jackycute · commit 067cfe2d1eed · 2018-12-28T16:42:55.000+08:00
Signed-off-by: Max Wu &lt;jackymaxj@gmail.com&gt;
diff --git a/public/js/render.js b/public/js/render.js
@@ -45,7 +45,7 @@ var filterXSSOptions = {
     // allow comment tag
     if (tag === '!--') {
             // do not filter its attributes
-      return html
+      return html.replace(/<(?!!--)/g, '&lt;').replace(/-->/g, '__HTML_COMMENT_END__').replace(/>/g, '&gt;').replace(/__HTML_COMMENT_END__/g, '-->')
     }
   },
   onTagAttr: function (tag, name, value, isWhiteAttr) {

Original file line number	Diff line number	Diff line change
`@@ -45,7 +45,7 @@ var filterXSSOptions = {`
`45`	`45`	`// allow comment tag`
`46`	`46`	`if (tag === '!--') {`
`47`	`47`	`// do not filter its attributes`
`48`		`- return html`
	`48`	`+ return html.replace(/<(?!!--)/g, '<').replace(/-->/g, '__HTML_COMMENT_END__').replace(/>/g, '>').replace(/__HTML_COMMENT_END__/g, '-->')`
`49`	`49`	`}`
`50`	`50`	`},`
`51`	`51`	`onTagAttr: function (tag, name, value, isWhiteAttr) {`