fix: apply xss and redos vulnerabilities fixes from main repo

- parallax#2806 - parallax#3091
pmstss · Jul 18, 2022 · 45ac864 · 45ac864
1 parent 190b710
commit 45ac864
Show file tree

Hide file tree

Showing 8 changed files with 6,213 additions and 6,227 deletions.
diff --git a/dist/jspdf.debug.js b/dist/jspdf.debug.js
diff --git a/dist/jspdf.min.js b/dist/jspdf.min.js
diff --git a/dist/jspdf.node.debug.js b/dist/jspdf.node.debug.js
diff --git a/dist/jspdf.node.min.js b/dist/jspdf.node.min.js
diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -24,6 +24,7 @@
   },
   "dependencies": {
     "canvg": "2.0.0",
+    "dompurify": "^2.3.9",
     "file-saver": "eligrey/FileSaver.js#1.3.8",
     "html2canvas": "1.0.0-alpha.12",
     "omggif": "1.0.10",

diff --git a/src/modules/addimage.js b/src/modules/addimage.js
@@ -491,7 +491,7 @@
         var result = null;
 
         if (dataUrlParts.length === 2) {
-            var extractedInfo = /^data:(\w*\/\w*);*(charset=[\w=-]*)*;*$/.exec(dataUrlParts[0]);
+            var extractedInfo = /^data:(\w*\/\w*);*(charset=(?!charset=)[\w=-]*)*;*$/.exec(dataUrlParts[0]);
             if (Array.isArray(extractedInfo)) {
                 result = {
                     mimeType : extractedInfo[1],

diff --git a/src/modules/html.js b/src/modules/html.js
@@ -43,11 +43,7 @@
 	  var el = document.createElement(tagName);
 	  if (opt.className)  el.className = opt.className;
 	  if (opt.innerHTML) {
-		el.innerHTML = opt.innerHTML;
-		var scripts = el.getElementsByTagName('script');
-		for (var i = scripts.length; i-- > 0; null) {
-		  scripts[i].parentNode.removeChild(scripts[i]);
-		}
+      el.innerHTML = DOMPurify.sanitize(opt.innerHTML);
 	  }
 	  for (var key in opt.style) {
 		el.style[key] = opt.style[key];