[security] a better override of SimpleMDE markdown rendering

to prevent XSS vulnerabilities in SimpleMDE
kiwitcms · Jan 20, 2019 · 571d6f2 · 571d6f2
1 parent 85e1bb9
commit 571d6f2
Show file tree

Hide file tree

Showing 2 changed files with 18 additions and 5 deletions.
diff --git a/tcms/core/widgets.py b/tcms/core/widgets.py
@@ -26,4 +26,5 @@ class Media:
             'all': ['simplemde/dist/simplemde.min.css']
         }
         js = ['simplemde/dist/simplemde.min.js',
+              'marked/marked.min.js',
               'js/simplemde_security_override.js']
diff --git a/tcms/static/js/simplemde_security_override.js b/tcms/static/js/simplemde_security_override.js
@@ -8,10 +8,22 @@
     https://snyk.io/vuln/SNYK-JS-SIMPLEMDE-72570
 */
 
-SimpleMDE.prototype._upstream_markdown = SimpleMDE.prototype.markdown;
-
 SimpleMDE.prototype.markdown = function(text) {
-    var marked = SimpleMDE.prototype._upstream_markdown();
-    marked.setOptions({ sanitize: true });
-    return marked;
+    var markedOptions = { sanitize: true };
+
+    if(this.options && this.options.renderingConfig && this.options.renderingConfig.singleLineBreaks === false) {
+        markedOptions.breaks = false;
+    } else {
+        markedOptions.breaks = true;
+    }
+
+    if(this.options && this.options.renderingConfig && this.options.renderingConfig.codeSyntaxHighlighting === true && window.hljs) {
+        markedOptions.highlight = function(code) {
+            return window.hljs.highlightAuto(code).value;
+        };
+    }
+
+    marked.setOptions(markedOptions);
+
+    return marked(text);
 }