From be62caef2babec5e65ba8b9d06ad3ff4e4d71d4e Mon Sep 17 00:00:00 2001 From: yuri Date: Thu, 13 Sep 2018 14:03:01 +0300 Subject: [PATCH] fix wysiwyg xss --- client/src/views/fields/wysiwyg.js | 1 + 1 file changed, 1 insertion(+) diff --git a/client/src/views/fields/wysiwyg.js b/client/src/views/fields/wysiwyg.js index a61ad38c46..68927dde7e 100644 --- a/client/src/views/fields/wysiwyg.js +++ b/client/src/views/fields/wysiwyg.js @@ -148,6 +148,7 @@ Espo.define('views/fields/wysiwyg', ['views/fields/text', 'lib!Summernote'], fun if (value) { value = value.replace(/<[\/]{0,1}(base)[^><]*>/gi, ''); value = value.replace(/<[\/]{0,1}(script)[^><]*>/gi, ''); + value = value.replace(/<[^><]*(onerror|onclick|onmouseover|onmousedown|onmouseenter|onmouseout|mouseleave|onchange|onblur)=[^><]*>/gi, ''); } return value || ''; },