mirrors/CyberChef
1
0
Fork 0
mirror of https://github.com/gchq/CyberChef.git synced 2025-04-20 14:56:19 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

Added a CodeQL workflow to check for bugs through code analysis. Fixed numerous bugs and implemented safeguards as already reported.

Browse source
This commit is contained in:
n1474335 2021-02-10 13:13:19 +00:00
parent 892a3716ed
commit 1abc46058c
32 changed files with 87 additions and 61 deletions
Download patch file Download diff file Expand all files Collapse all files

7
src/core/Utils.mjs
View file

@ -705,7 +705,7 @@ class Utils {
*/
static stripHtmlTags(htmlStr, removeScriptAndStyle=false) {
if (removeScriptAndStyle) {
htmlStr = htmlStr.replace(/<(script|style)[^>]*>.*<\/(script|style)>/gmi, "");
htmlStr = htmlStr.replace(/<(script|style)[^>]*>.*?<\/(script|style)>/gi, "");
}
return htmlStr.replace(/<[^>]+>/g, "");
}
@ -729,11 +729,10 @@ class Utils {
">": "&gt;",
'"': "&quot;",
"'": "&#x27;", // &apos; not recommended because it's not in the HTML spec
"/": "&#x2F;", // forward slash is included as it helps end an HTML entity
"`": "&#x60;"
};
return str.replace(/[&<>"'/`]/g, function (match) {
return str.replace(/[&<>"'`]/g, function (match) {
return HTML_CHARS[match];
});
}
@ -879,7 +878,7 @@ class Utils {
while ((m = recipeRegex.exec(recipe))) {
// Translate strings in args back to double-quotes
args = m[2]
.replace(/"/g, '\\"') // Escape double quotes
.replace(/"/g, '\\"') // Escape double quotes lgtm [js/incomplete-sanitization]
.replace(/(^|,|{|:)'/g, '$1"') // Replace opening ' with "
.replace(/([^\\]|(?:\\\\)+)'(,|:|}|$)/g, '$1"$2') // Replace closing ' with "
.replace(/\\'/g, "'"); // Unescape single quotes