fix editable colum xss

Power-Components · Nov 24, 2021 · 29ccabc · 29ccabc
1 parent bd27b38
commit 29ccabc
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 3 deletions.
diff --git a/resources/views/assets/scripts.blade.php b/resources/views/assets/scripts.blade.php
@@ -13,6 +13,12 @@ function copyToClipboard(button) {
         document.body.removeChild(el);
     }
 
+    function htmlSpecialChars(string) {
+        const el = document.createElement('div');
+        el.innerText = string;
+        return el.innerHTML;
+    }
+
     function isV2() {
         return window.Alpine && window.Alpine.version && /^2\..+\..+$/.test(window.Alpine.version)
     }

diff --git a/resources/views/components/editable.blade.php b/resources/views/components/editable.blade.php
@@ -12,7 +12,7 @@
        field: '{{ $field }}',
        content: '{{ addslashes($row->{$field}) }}'
     }">
-    <div x-text="content"
+    <div x-html="content"
          style="border-bottom: dotted 1px; cursor: pointer"
          x-show="!editable"
          x-on:dblclick="editable = true"
@@ -22,12 +22,12 @@
         <input
             type="text"
             x-on:dblclick="editable = true"
-            x-on:keydown.enter="sendEventInputChanged($event, id, field); editable = false; content = $event.target.value"
+            x-on:keydown.enter="sendEventInputChanged($event, id, field); editable = false; content = htmlSpecialChars($event.target.value)"
             :class="{'cursor-pointer': !editable}"
             class="{{ $theme->inputClass }} p-2"
             x-ref="editable"
             x-text="content"
-            :value="content">
+            :value="$root.firstElementChild.innerText">
     </div>
 </div>