网络安全漏洞修复

[yang870516]

Hi! 👋

Firstly, thanks for your work on this project! 🙂

Today I used patch-package to patch less@2.7.3 for the project I'm working on.

Here is the diff that solved my problem:

diff --git a/node_modules/less/dist/less.js b/node_modules/less/dist/less.js
index 98c00a7..ecd2b69 100644
--- a/node_modules/less/dist/less.js
+++ b/node_modules/less/dist/less.js
@@ -258,8 +258,8 @@ module.exports = function(window, less, options) {
         if (e.stack && (e.extract || options.logLevel >= 4)) {
             content += '<br/>Stack Trace</br />' + e.stack.split('\n').slice(1).join('<br/>');
         }
-        elem.innerHTML = content;
-
+        //网络安全漏洞修复 20231107 yangxl
+        (elem.textContent != undefined ) ? (elem.textContent = content):(elem.innerText = content);
         // CSS for error messages
         browser.createCSS(window.document, [
             '.less-error-message ul, .less-error-message li {',
@@ -611,7 +611,9 @@ module.exports = function(window, options) {
             if (style.type.match(typePattern)) {
                 var instanceOptions = clone(options);
                 instanceOptions.modifyVars = modifyVars;
-                var lessText = style.innerHTML || '';
+               //网络安全漏洞修复 20231107 yangxl
+               let _textValue = (style.textContent != undefined ) ? style.textContent :style.innerText;
+                var lessText = _textValue || '';
                 instanceOptions.filename = document.location.href.replace(/#.*$/, '');

                 /*jshint loopfunc:true */
@@ -625,7 +627,7 @@ module.exports = function(window, options) {
                                 if (style.styleSheet) {
                                     style.styleSheet.cssText = result.css;
                                 } else {
-                                    style.innerHTML = result.css;
+                                    _textValue = result.css;
                                 }
                             }
                         }, null, style));

This issue body was partially generated by patch-package.