fix(markdown): XSS Prevention (#1832)

nuxt · Jan 20, 2023 · 67c9fcf · 67c9fcf · OhB00 · Jan 23, 2023
1 parent 1cb91f5
commit 67c9fcf
Show file tree

Hide file tree

Showing 3 changed files with 22 additions and 0 deletions.
diff --git a/src/runtime/components/ContentRendererMarkdown.vue b/src/runtime/components/ContentRendererMarkdown.vue
@@ -115,6 +115,10 @@ function renderNode (node: MarkdownNode, h: CreateElement, documentMeta: ParsedC
     return h(Text, node.value)
   }
 
+  if (node.tag === 'script') {
+    return renderToText(node)
+  }
+
   const originalTag = node.tag!
   // `_ignoreMap` is an special prop to disables tag-mapper
   const renderTag: string = (typeof node.props?.__ignoreMap === 'undefined' && documentMeta.tags[originalTag]) || originalTag
@@ -137,6 +141,18 @@ function renderNode (node: MarkdownNode, h: CreateElement, documentMeta: ParsedC
   )
 }
 
+function renderToText (node: MarkdownNode) {
+  if (node.type === 'text') {
+    return node.value
+  }
+
+  if (!node.children?.length) {
+    return `<${node.tag}>`
+  }
+
+  return `<${node.tag}>${node.children?.map(renderToText).join('') || ''}</${node.tag}>`
+}
+
 function renderBinding (node: MarkdownNode, h: CreateElement, documentMeta: ParsedContentMeta, parentScope: any = {}): VNode {
   const data = {
     ...parentScope,

diff --git a/test/features/renderer-markdown.ts b/test/features/renderer-markdown.ts
@@ -88,5 +88,10 @@ export const testMarkdownRenderer = () => {
       expect(html).not.contains('<meta property="og:image" content="https://picsum.photos/200/300">')
       expect(html).not.contains('<meta name="description" content="Description overwritten"><meta property="og:image" content="https://picsum.photos/200/300">')
     })
+
+    test('XSS Prevention', async () => {
+      const html = await $fetch('/_partial/xss')
+      expect(html).contains('&lt;script&gt;console.log(&#39;xss&#39;)&lt;/script&gt;')
+    })
   })
 }
diff --git a/test/fixtures/basic/content/_partial/xss.md b/test/fixtures/basic/content/_partial/xss.md
@@ -0,0 +1 @@
+<script>console.log('xss')</script>