Merge pull request #592 from matt-/xss_html_entities

XSS with HTML entities
markedjs · Jul 29, 2016 · fd0d1a2 · fd0d1a2
2 parents 88ce4df + 0fa05b6
commit fd0d1a2
Show file tree

Hide file tree

Showing 3 changed files with 13 additions and 1 deletion.
diff --git a/lib/marked.js b/lib/marked.js
@@ -1094,7 +1094,8 @@ function escape(html, encode) {
 }
 
 function unescape(html) {
-  return html.replace(/&([#\w]+);/g, function(_, n) {
+	// explicitly match decimal, hex, and named HTML entities 
+  return html.replace(/&(#(?:\d+)|(?:#x[0-9A-Fa-f]+)|(?:\w+));?/g, function(_, n) {
     n = n.toLowerCase();
     if (n === 'colon') return ':';
     if (n.charAt(0) === '#') {

diff --git a/test/tests/links.sanitize.html b/test/tests/links.sanitize.html
@@ -0,0 +1,4 @@
+<p></p>
+<p></p>
+<p></p>
+<p></p>
diff --git a/test/tests/links.sanitize.text b/test/tests/links.sanitize.text
@@ -0,0 +1,7 @@
+[URL](javascript:alert)
+
+[URL](vbscript:alert)
+
+[URL](javascript&colon;alert&#40;1&#41;)
+
+[URL](javascript&#58document;alert&#40;1&#41;)
-Original file line number
+Diff line change
@@ -0,0 +1,4 @@
+    <p></p>
+    <p></p>
+    <p></p>
+    <p></p>