From ae1326e2df02f5112324bb882b2240b251b3c008 Mon Sep 17 00:00:00 2001 From: Nicholas Ray Date: Mon, 7 Sep 2020 17:09:53 -0600 Subject: [PATCH] Remove regex section line replacement from PageGateway This line seems to be doing more harm than good as it can convert inert, escaped HTML into HTML that is vulnerable to XSS. If this HTML gets sent to jQuery's `parseHTML` method, image callbacks can fire even without the element being appended to the DOM. Apparently, it was added back in 2014 in commit 78f85803f64ae3ecedbecb38473ee70606fca5c9, however its continued use is questionable at best and it has no obvious usages. Bug: T262213 Change-Id: Ibbe572b00d3baf70a77b682bd7e4361e0d72379d --- resources/dist/mobile.common.js | Bin 49873 -> 49811 bytes resources/dist/mobile.common.js.map.json | Bin 214251 -> 214064 bytes src/mobile.startup/PageGateway.js | 3 --- 3 files changed, 3 deletions(-) diff --git a/resources/dist/mobile.common.js b/resources/dist/mobile.common.js index 3895ca5ea53751a206e636ace1c08d1804ac9330..9f33d3101dae9186e99cbe5a41ebed6d5635cc8f 100644 GIT binary patch delta 14 WcmccE$~?K1dBZmQ&0p;AHUR)MI|p9? delta 77 zcmbQ-%6zevdBZk)yR!Vu6a@oCTiaB5 Xj)Y-hv{%#Wh5Xl-O diff --git a/resources/dist/mobile.common.js.map.json b/resources/dist/mobile.common.js.map.json index 86d813db59ed4eab04242bfc03e0cf8995282a51..71132794a07088a670ac3adf121e2c93de8a6747 100644 GIT binary patch delta 3885 zcmai1Ta1&}5tbJy-bxE?mK2Df5Uxe**0=R~SI~rWj=jG8`}_B0ZDR-6n8oY6*SFpE zy0kP(AdS>kA_vGr`_P9LQmIhjMgz3TZXY&TZjc3JT5O~zWQPecQTzxTa1Y=ANQkNMs31P76{8f zXR>GAzA`7BO^yNuPImAE+PeZ2vd|(P2^YtOlebAQ-<M1E`cN6?lsP^j*#c z;6lmQ5|cK8@Tc*jax>SE_E&bC%>zyr>vH&n7Ddko0*N@eTp@)ya<#>~QS?AtilUo3 zLJnk6m}QDlTM|BCAhyUWQCl7jQ4We>IDsHI11P9F5KQiLDQueuFin9ngXwY@4~>d^ z^h)Y0?kK`B<~0hJLXgo=f4W8TD!FYLKYk=Pfk73gOF9V$QH>UYD21~0f2`pHd%o}p z=1e3JvdH#0BpjlQ+3*H2i*sYa$6I3*JksKi_vGJ>@3y$)7fx)q)|HXAbe`D$yj?*q zXn4P_SkRC&Cw5yZ^4lj|^_B*P6G+X7ri8*BB91mH(7%Ljfdg=l+8YzL5@)Q&qnP_H ze@b+g`Q!E&0`3PtT+~u&miDNHrRu5W@i81aY4BtD(Nk%nk>)Y0w*Uk9E8 zkgGnNA|FOg$LRx>O>Q5-0pFmaM$OatMa$5rfwEY7vA9G2WiB|}*4J(~RQlVJ7xrv+ zQIY6CY-kQ0zYG^%kl!mb2fa$GJ!Wn!Zdt!=G>%4$P89u%wegZ@a8F#it8ZWh^?Q{l za}UKTHi~Itc?7C;R70Wyqb67O_4-8eQBP~ge^xt#^Hi03D`76y&JS2!s-_+0`o_?P zO;6x2@|wA8p*S$)REa=Cvt#n&QgUqv;N%v}e=O}<{~Rcs2{FPU$D^MK_kg%7@U;d4j8d18silBZkPE?626B#uRqo*DQz zogED;5mZhUSEW`Ps>`>}*$0~uWSE<~<*&~rtfNX@$J~FOt$V59!?PCeDbB+b0R71( zauSG{W`2mJ!Fa%UW*k%i6N?(AHVa5bvwohPXhW8xlK?ir-(>)dG`lLEsa}09Qgc8P)TsE%5yA+ z$H_(tKH^jpKP)yun_AZgF%hR0lDL_HJ_8?ZL>|3z@XKx0QhFL7^f!b<87Zq+mgKoB zHE&TZ%FuP7eYAN=U1?9+DzMI%kAXVBQ!JOLD#NQb<)N#Gd?hM*trEvf=c-B*tT07b z5G^rgdDCu!vNkEQea4g+9dM*iah z76PaXIJvT?RnP>usg%PCdm_T0>u=SP)KiL8+5BLOym5WAwSniEc+-4%{Yw_>BHc8W zdk*FtO<)3pQyK-@dLEVB{kyEK4+Syf1I>ZK}MPoX( zRH505c4v=4TC$o~;q@cGrd_m1dXwA9VLv5gfd)YWycZLEUVe6iuR?Xn!#7>5i*Q(M zneO^~Ni38E-lu1Po43(gI^GLV1rg4w0b4*6%G!v$e$#%qoC3c28@!N$BOg4fL!H)(7$S8zKmp7vzDhM+yLmQ?CsIeTR+ov$3h6n2io^DWm03=YWsgc~F z=ApH8ve%^Pq_xc7nIEiM8!__Yo$jb8gZm;FSVJ)Y zb9Ur@#M;Fc3l$(=yT5<9i?2NvV}MM<*H=(qmha!+x9V<5escft-bIRjVu7L@f)%7& zf1=PjqGyU~mfIf8 zsq6;e^#+b=4*A^&Vh}{(wcQgH`TGY4&qB+`fUJff%p7FhXdPRNUD`!kfpQj8=u|0$ zvc-GFJbpBQRs9J{3fKw5VZH%QS}2+f8Lo@n+fJ$6!4%9 yz@u?o%8y_6|8E3B{C@s)5qHNk+$n2*oy5WPGa?WziY>}zkdGw*>Mu5ZdxaG{C>pG z#NAe)>tIM|jH?0CG%8UMuHBa= zR4HHYz2~0uJHPX~UjA11omaY-FKk?$P37awpKQF>(fr}2bBE97_=H7gR)yKP#m!hK zW(mPx{4?pc7>xUCy2Z;_TB+)IZWI&{=hH={y;2#|A6co>a1T_Z6vi@&MP=?qSCFI^ z6ibA$Ind`RD&z2Rb1@Oww)WS77t^dW8z1V>9bB(S|M;{vYk)} zFn&C6jU!6$A|CMp1s8UuN`mpm7(&h~OJk@wUONVum{vcAI7$j#Vd0i6BN4g*E_j&R z!Si0U8WxMwn|%)%KhXzvjsU{Z3o7v? z5kyqfKUqQfR+>~rcl3bCimdX}8DT`9SzmI2a+fcGn0OfR@oBqwF}iKdC^4dXfk1cA zE`A>E?HCfDL^qj=8d<4|yU|VSlPbYTsTkV43~fnlKGEBe6Z=mLoUN#!KZJ?vSEZ1z zM%kbabHp67R22X-BKJl)2J!q*zi7qJsMq^&Pi*j4%Xe+!Bw0JCLKX2$zbdcw~EdF}( z!>*+urB@>;V!TJZe`?4?JKhO<^UkSzook_(h%0b@7CH0|H1Evq=~x4NV9fyoP#goz z?eSVi_ppw#SVcx~N&I;JXirtUf4eAyz99ZHzw_xKN_UI^)OpP<{xIJoSYoluA+;uh z&EF)}t$rp$V!DIaForOpcu~m)#J$W*SPQM*!_&%$6dBemF=z-B?3(N?6lFJ3oOU%@ z>EojIR1zO%D_u4X3D5=uO?&R;PScRA&ZXwnLid-}JcK`~WSW1fBs;r733(2N=7xk` z58vMbII(i`QhodCwa_O>2)5#&-#t+gpPo6{ox{MiGA|?i&;Rr30YeJP-kNA?FYM`f zOySpFeC>(uDwQq@hfi0;w(}b{4f|yBU}LAU%2Jc`7KL`++EwINmG^X z&eg=H-+ieY$_uhEMq>76`L)khbr;5@Uob2Jc5&u)V;kfzP@*qVx6Gx zr^I^k-`BT4*E$&W%9)dZvTrDr02*jtvNo0Pk93%TI;@^l^XotO%c?DA0u+L-Lw*yM z%q(6roTBl@k;g4$16+qq6&g0Q*x70r zR}rV&92KAabnmvR>=t$vaJq}!CQU)x!FvgDwoUQ(3w^E(b$>M##2yn%OSQ1VNC9)a#E+q+Nr$x2J^`=nN=w=)jJMbAgwTwGDi`4C^6{8scsYX_Z&y6q&?@h$ie zpUW)m+sBYIBSR9QY#3JVc^jr(ENIiQOU+SdYDg87k5l&ee6qR6ZL|pA z-@_&X?;9G7(94}lPQ1IUwDH))zm^AB4Q(=`PFLNFVJQtv;HdTvDhue!WU%4E1B1Y% zb=ZP5p)ie#)Ftcw?T~y2{?P8Q8nuA_}?dM8+x(-s$QwJcRkh75yaqE&j3dr&8 zn4hK?WTwgU`%c4P&2sEGV>MYDxd^pp`#9aIVFOYfN{BM04vHaBBX9^w95RQ+sSoxa zft8m{Hk8B!x)3Hm05tdkZ&>h5H_J{k5_woj46XqSMeY!P{$R}H^ddanDf*gQJ{bodMJ`C)QTFiT^F}*%*zOS=$8f*rto~s zyFe5k)eW8!;^VzecmN_HZ3=vBiLC3zsRx0x(UvDUjghm<$fd-^o6mkZbqu!#6_{0^ zMNf!rH=kYKn3fRi7!QN{AbbKBbr+fQ)&qVXl3jTXU>fj@n z`b+U*HZ~XE*K0ixjam=KqS4voGlx!m^^i4T>D{}xw{O4H@`C)dRh7Tld9LGf=ef@Q GmHz>meytq< diff --git a/src/mobile.startup/PageGateway.js b/src/mobile.startup/PageGateway.js index 091cb6b3b..dd2e0758d 100644 --- a/src/mobile.startup/PageGateway.js +++ b/src/mobile.startup/PageGateway.js @@ -52,9 +52,6 @@ function transformSections( sections ) { // if the first section level is not equal to collapseLevel, this first // section will not have a parent and will be appended to the result. sections.forEach( function ( section ) { - if ( section.line !== undefined ) { - section.line = section.line.replace( /<\/?a\b[^>]*>/g, '' ); - } section.subsections = []; if ( -- 2.20.1