Pi-Hole/web
1
0
Fork 0
mirror of https://github.com/pi-hole/web.git synced 2025-12-24 12:48:29 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge commit from fork

Browse Source 
HTML escape adlist URL and non-domain entried before printing it in gravity stream
This commit is contained in:
Adam Warner
2025-10-25 10:08:44 +01:00
committed by GitHub
parent 4d39206b33 febc2b870a
commit 4159aaade6
1 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
scripts/js/gravity.js
View File

@@ -5,7 +5,7 @@
* This file is copyright under the latest version of the EUPL. * This file is copyright under the latest version of the EUPL.
* Please see LICENSE file for your rights under this license. */ * Please see LICENSE file for your rights under this license. */
/* global apiFailure:false */ /* global apiFailure:false, utils:false */
"use strict"; "use strict";
@@ -89,9 +89,11 @@ function parseLines(outputElement, text) {
const lines = text.split(/(?=\r)/g); const lines = text.split(/(?=\r)/g);
for (let line of lines) { for (let line of lines) {
// Escape HTML to prevent XSS attacks (both in adlist URL and non-domain entries)
line = utils.escapeHtml(line);
if (line[0] === "\r") { if (line[0] === "\r") {
// This line starts with the "OVER" sequence. Replace them with "\n" before print // This line starts with the "OVER" sequence. Replace them with "\n" before print
line = line.replaceAll("\r", "\n").replaceAll("\r", "\n"); line = line.replaceAll("\r\u001B[K", "\n").replaceAll("\r", "\n");
// Last line from the textarea will be overwritten, so we remove it // Last line from the textarea will be overwritten, so we remove it
const lastLineIndex = outputElement.innerHTML.lastIndexOf("\n"); const lastLineIndex = outputElement.innerHTML.lastIndexOf("\n");