From 273a69258a41112d0fe908391597aa62cdbfeafd Mon Sep 17 00:00:00 2001
From: Geometrically <18202329+Geometrically@users.noreply.github.com>
Date: Sun, 28 May 2023 16:00:25 -0400
Subject: [PATCH] Fix wrong func being parsed, md parser (#1169)
---
helpers/parse.js | 16 +++++++++++++---
layouts/default.vue | 6 ++++--
nuxt.config.ts | 2 --
3 files changed, 17 insertions(+), 7 deletions(-)
diff --git a/helpers/parse.js b/helpers/parse.js
index 24487131e..c04b46716 100644
--- a/helpers/parse.js
+++ b/helpers/parse.js
@@ -19,6 +19,11 @@ export const configuredXss = new xss.FilterXSS({
area: [...xss.whiteList.a, 'coords'],
a: [...xss.whiteList.a, 'rel'],
},
+ css: {
+ whiteList: {
+ 'image-rendering': /^pixelated$/,
+ },
+ },
onIgnoreTagAttr: (tag, name, value) => {
// Allow iframes from acceptable sources
if (tag === 'iframe' && name === 'src') {
@@ -53,7 +58,7 @@ export const configuredXss = new xss.FilterXSS({
return name + '="' + xss.escapeAttrValue(value) + '"'
}
},
- safeAttrValue(tag, name, value, _cssFilter) {
+ safeAttrValue(tag, name, value, cssFilter) {
if (tag === 'img' && name === 'src' && !value.startsWith('data:')) {
try {
const url = new URL(value)
@@ -75,12 +80,17 @@ export const configuredXss = new xss.FilterXSS({
]
if (!allowedHostnames.includes(url.hostname)) {
- return `https://wsrv.nl/?url=${encodeURIComponent(value)}&n=-1`
+ return xss.safeAttrValue(
+ tag,
+ name,
+ `https://wsrv.nl/?url=${encodeURIComponent(value)}&n=-1`,
+ cssFilter
+ )
}
} catch (err) {}
}
- return value
+ return xss.safeAttrValue(tag, name, value, cssFilter)
},
})
diff --git a/layouts/default.vue b/layouts/default.vue
index 968c99bdc..c48f773f8 100644
--- a/layouts/default.vue
+++ b/layouts/default.vue
@@ -297,7 +297,9 @@