d4708
/
qBittorrent
mirror of https://github.com/d47081/qBittorrent.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity
Browse Source

Merge pull request #13537 from SeproDE/betterSanetizeRSS 

Place WebUI RSS description in sandboxed iframe
adaptive-webui-19844
Mike Tzou 4 years ago committed by GitHub
parent
05c7796909 6c016cf443
commit
b636bf4b2a
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 13 additions and 4 deletions
Whitespace
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Unified View
Diff Options
Show Stats Download Patch File Download Diff File
  1. 17
      src/webui/www/private/views/rss.html

17
src/webui/www/private/views/rss.html
Unescape View File

@ -72,6 +72,11 @@
width: 100%; width: 100%;
} }
#rssDescription {
width: 100%;
border: none;
}
</style> </style>
<div id="rssView"> <div id="rssView">
@ -423,11 +428,15 @@
return torrentDate; return torrentDate;
})()); })());
// Strip script before interpreting html // Place in iframe with sandbox atribute to prevent js execution
let torrentDescription = document.createRange().createContextualFragment( let torrentDescription = document.createRange().createContextualFragment('<iframe sandbox id="rssDescription"></iframe>');
'<div id="rssTorrentDetailsDescription">' + article.description.stripScripts() + '</div>');
$('rssDetailsView').append(torrentDescription); $('rssDetailsView').append(torrentDescription);
document.getElementById('rssDescription').srcdoc = '<html><head><link rel="stylesheet" type="text/css" href="css/style.css" /></head><body>' + article.description + "</body></html>";
//calculate height to fill screen
document.getElementById('rssDescription').style.height =
"calc(100% - " + document.getElementById('rssTorrentDetailsName').offsetHeight + "px - " +
document.getElementById('rssTorrentDetailsDate').offsetHeight + "px - 5px)";
} }
}; };

Write Preview
Loading…
Cancel
Save