fix: xss vulnerability (#752) (#879)

* env: update dependencies * also updates `package-lock.json` file * env: add dompurify package * fix: sanitize template for preventing xss attack * env: update tui-time-picker
nhn · Aug 30, 2021 · 064de34 · 064de34
1 parent b05f074
commit 064de34
Show file tree

Hide file tree

Showing 8 changed files with 14,614 additions and 49 deletions.
diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -101,8 +101,9 @@
     "doc": "tuidoc"
   },
   "dependencies": {
+    "dompurify": "^2.3.1",
     "tui-code-snippet": "^1.5.0",
-    "tui-date-picker": "^4.0.2",
-    "tui-time-picker": "^2.0.1"
+    "tui-date-picker": "^4.3.0",
+    "tui-time-picker": "^2.1.4"
   }
 }
diff --git a/src/js/view/month/month.js b/src/js/view/month/month.js
@@ -4,6 +4,7 @@
  */
 'use strict';
 
+var DOMPurify = require('dompurify');
 var util = require('tui-code-snippet');
 var config = require('../../config'),
     datetime = require('../../common/datetime'),
@@ -238,7 +239,7 @@ Month.prototype.render = function() {
         styles: styles
     };
 
-    vLayout.panels[0].container.innerHTML = tmpl(baseViewModel);
+    vLayout.panels[0].container.innerHTML = DOMPurify.sanitize(tmpl(baseViewModel));
 
     this._renderChildren(vLayout.panels[1].container, calendar, theme);
 

diff --git a/src/js/view/month/weekdayInMonth.js b/src/js/view/month/weekdayInMonth.js
@@ -4,6 +4,7 @@
  */
 'use strict';
 
+var DOMPurify = require('dompurify');
 var util = require('tui-code-snippet');
 var config = require('../../config'),
     common = require('../../common/common.js'),
@@ -114,7 +115,7 @@ WeekdayInMonth.prototype.render = function(viewModel) {
         setIsOtherMonthFlag(baseViewModel.dates, this.options.renderMonth, viewModel.theme);
     }
 
-    container.innerHTML = baseTmpl(baseViewModel);
+    container.innerHTML = DOMPurify.sanitize(baseTmpl(baseViewModel));
 
     scheduleContainer = domutil.find(
         config.classname('.weekday-schedules'),
@@ -125,7 +126,7 @@ WeekdayInMonth.prototype.render = function(viewModel) {
         return;
     }
 
-    scheduleContainer.innerHTML = scheduleTmpl(baseViewModel);
+    scheduleContainer.innerHTML = DOMPurify.sanitize(scheduleTmpl(baseViewModel));
 
     common.setAutoEllipsis(
         config.classname('.weekday-schedule-title'),

diff --git a/src/js/view/week/dayGrid.js b/src/js/view/week/dayGrid.js
@@ -4,6 +4,7 @@
  */
 'use strict';
 
+var DOMPurify = require('dompurify');
 var util = require('tui-code-snippet');
 var config = require('../../config'),
     common = require('../../common/common'),
@@ -152,7 +153,7 @@ DayGrid.prototype.render = function(viewModel) {
         scheduleContainerTop = this.options.scheduleContainerTop;
     var dayGridSchedule;
 
-    container.innerHTML = baseTmpl(baseViewModel);
+    container.innerHTML = DOMPurify.sanitize(baseTmpl(baseViewModel));
 
     this.children.clear();
 

diff --git a/src/js/view/week/dayGridSchedule.js b/src/js/view/week/dayGridSchedule.js
@@ -4,6 +4,7 @@
  */
 'use strict';
 
+var DOMPurify = require('dompurify');
 var util = require('tui-code-snippet');
 var Weekday = require('../weekday'),
     tmpl = require('../template/week/dayGridSchedule.hbs');
@@ -38,7 +39,7 @@ DayGridSchedule.prototype.render = function(viewModel) {
 
     baseViewModel = this.getBaseViewModel(viewModel);
 
-    container.innerHTML = tmpl(baseViewModel);
+    container.innerHTML = DOMPurify.sanitize(tmpl(baseViewModel));
 
     this.fire('afterRender', baseViewModel);
 };

diff --git a/src/js/view/week/dayname.js b/src/js/view/week/dayname.js
@@ -4,6 +4,7 @@
  */
 'use strict';
 
+var DOMPurify = require('dompurify');
 var util = require('tui-code-snippet');
 var config = require('../../config');
 var common = require('../../common/common');
@@ -98,7 +99,7 @@ DayName.prototype.render = function(viewModel) {
         styles: styles
     });
 
-    this.container.innerHTML = daynameTmpl(baseViewModel);
+    this.container.innerHTML = DOMPurify.sanitize(daynameTmpl(baseViewModel));
 };
 
 /**

diff --git a/src/js/view/week/timeGrid.js b/src/js/view/week/timeGrid.js
@@ -4,6 +4,7 @@
  */
 'use strict';
 
+var DOMPurify = require('dompurify');
 var util = require('tui-code-snippet');
 var config = require('../../config');
 var common = require('../../common/common');
@@ -477,7 +478,7 @@ TimeGrid.prototype.render = function(viewModel) {
 
     baseViewModel.showHourMarker = baseViewModel.todaymarkerLeft >= 0;
 
-    container.innerHTML = mainTmpl(baseViewModel);
+    container.innerHTML = DOMPurify.sanitize(mainTmpl(baseViewModel));
 
     /**********
      * Render sticky container for timezone display label
@@ -510,7 +511,7 @@ TimeGrid.prototype.render = function(viewModel) {
 TimeGrid.prototype.renderStickyContainer = function(baseViewModel) {
     var stickyContainer = this.stickyContainer;
 
-    stickyContainer.innerHTML = timezoneStickyTmpl(baseViewModel);
+    stickyContainer.innerHTML = DOMPurify.sanitize(timezoneStickyTmpl(baseViewModel));
 
     stickyContainer.style.display = baseViewModel.timezones.length > 1 ? 'block' : 'none';
     stickyContainer.style.width = baseViewModel.styles.leftWidth;