webapp/bookstack
1
0
Fork 0
mirror of https://github.com/BookStackApp/BookStack.git synced 2025-07-28 17:02:04 +03:00
Code Activity

Made MD editor display a sandboxed iframe

Browse Source 
- Also added escaping of srcdoc elements in escape logic.

Related to #1531
This commit is contained in:
Dan Brown
2019-08-26 12:16:50 +01:00
parent 2dfe6c2d56
commit 7cc17934a8
6 changed files with 39 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
app/Entities/Repos/EntityRepo.php
View File

@ -766,7 +766,7 @@ class EntityRepo
}
// Remove data or JavaScript iFrames
$badIframes = $xPath->query('//*[contains(@src, \'data:\')] | //*[contains(@src, \'javascript:\')]');
$badIframes = $xPath->query('//*[contains(@src, \'data:\')] | //*[contains(@src, \'javascript:\')] | //*[@srcdoc]');
foreach ($badIframes as $badIframe) {
$badIframe->parentNode->removeChild($badIframe);
}