docsifyjs / docsify

🃏 A magical documentation site generator.
https://docsify.js.org
MIT License
27.78k stars 5.68k forks source link

fix: enhancement of isExternal #2093

Closed sy-records closed 1 year ago

sy-records commented 1 year ago

Summary

Fix an xss vulnerability that was fed via email.

Fix https://github.com/docsifyjs/docsify/issues/1477#issuecomment-1594666599

What kind of change does this PR introduce?

For any code change,

Does this PR introduce a breaking change? (check one)

If yes, please describe the impact and migration path for existing applications:

Related issue, if any:

Tested in the following browsers:

vercel[bot] commented 1 year ago

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name Status Preview Comments Updated (UTC)
docsify-preview ✅ Ready (Inspect) Visit Preview 💬 Add feedback Jun 17, 2023 0:23am
codesandbox-ci[bot] commented 1 year ago

This pull request is automatically built and testable in CodeSandbox.

To see build info of the built libraries, click here or the icon next to each commit SHA.

Latest deployment of this branch, based on commit 942a162d2f91019c01065d5ffb03cfb94b7e020c:

Sandbox Source
docsify-template Configuration
Koooooo-7 commented 1 year ago

Could u plz add a test case on this for good understanding of this changes ?

Koooooo-7 commented 1 year ago

I checked the mail and yes that we need check the \ , is it harmful either when it contains more than 2 \\ ?

sy-records commented 1 year ago

One and more are problematic, so matching to one is OK.