Fixed a CodeQL vulnerability in js/mage/adminhtml/uploader/instance.js

MahoCommerce · Sep 24, 2024 · d5f04ae · d5f04ae
1 parent 38f80f6
commit d5f04ae
Show file tree

Hide file tree

Showing 2 changed files with 1 addition and 4 deletions.
diff --git a/.github/codeql-config.yml b/.github/codeql-config.yml
@@ -1,7 +1,6 @@
 
 paths-ignore:
   - 'js/prototype/prototype.js'
-  - 'js/mage/adminhtml/uploader/instance.js'
   - 'js/mage/adminhtml/wysiwyg/tiny_mce/setup.js'
   - 'js/prototype/validation.js'
   - 'js/extjs/ext-tree.js'

diff --git a/public/js/mage/adminhtml/uploader/instance.js b/public/js/mage/adminhtml/uploader/instance.js
@@ -484,9 +484,7 @@
             return str
                 .stripScripts()
                 // Remove inline event handlers like onclick, onload, etc
-                .replace(/(on[a-z]+=["][^"]+["])(?=[^>]*>)/img, '')
-                .replace(/(on[a-z]+=['][^']+['])(?=[^>]*>)/img, '')
-            ;
+                .replace(/\s+on(?:\w|-)*\s*=\s*(?:"[^"]*"|'[^']*'|[^\s>]+)/img, '');
         }
     });
 })(window, document);