Verified Commit 6b5727ce authored by Luc Didry's avatar Luc Didry

Fix #128 — Prevent XSS in localStorage import

parent fef978c7
Pipeline #83753 passed with stages
in 3 minutes and 30 seconds
......@@ -93,7 +93,7 @@ function importStorage(f) {
var hasImported = 0;
for (i = 0; i < newFiles.length; i++) {
var item = newFiles[i];
if (!itemExists(item.short)) {
if (validURL(item.url) && !itemExists(item.short)) {
addItem(item);
hasImported++;
}
......@@ -108,6 +108,19 @@ function importStorage(f) {
reader.readAsArrayBuffer(f[0]);
}
function validURL(str) {
try {
var url = new URL(str);
if (url.host) {
return true;
} else {
return false;
}
} catch(e) {
return false;
}
}
function delFile() {
var dlink = $(this).attr('data-dlink');
var short = $(this).attr('data-short');
......@@ -151,7 +164,12 @@ function massDelete(event) {
function populateFilesTable() {
$('#myfiles').empty();
var files = JSON.parse(localStorage.getItem('files'));
var files = localStorage.getItem('files');
if (files === null) {
files = new Array();
} else {
files = JSON.parse(files);
}
files.sort(function(a, b) {
if (a.created_at < b.created_at) {
return -1;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment