added explicit matching for HTML entities to prevent XSS

markedjs · May 19, 2015 · 2cff859 · 2cff859
1 parent 49b7eac
commit 2cff859
Show file tree

Hide file tree

Showing 3 changed files with 13 additions and 1 deletion.
diff --git a/lib/marked.js b/lib/marked.js
@@ -1094,7 +1094,8 @@ function escape(html, encode) {
 }
 
 function unescape(html) {
-  return html.replace(/&([#\w]+);/g, function(_, n) {
+	// explicitly match decimal, hex, and named HTML entities 
+  return html.replace(/&(#(?:\d+)|(?:#x[0-9A-Fa-f]+)|(\w+))/g, function(_, n) {
     n = n.toLowerCase();
     if (n === 'colon') return ':';
     if (n.charAt(0) === '#') {

diff --git a/test/tests/links.sanitize.html b/test/tests/links.sanitize.html
@@ -0,0 +1,4 @@
+<p></p>
+<p></p>
+<p></p>
+<p></p>
diff --git a/test/tests/links.sanitize.text b/test/tests/links.sanitize.text
@@ -0,0 +1,7 @@
+[URL](javascript:alert)
+
+[URL](vbscript:alert)
+
+[URL](javascript&colon;alert&#40;1&#41;)
+
+[URL](javascript&#58document;alert&#40;1&#41;)