From f6500ff745dc31f80df04271e9dfee5503e68a52 Mon Sep 17 00:00:00 2001 From: Calvin Montgomery Date: Tue, 14 Mar 2017 21:36:44 -0700 Subject: [PATCH] Fix emote regex due to sanitize-html changes --- package.json | 2 +- src/channel/emotes.js | 2 +- src/xss.js | 9 +++++++++ 3 files changed, 11 insertions(+), 2 deletions(-) diff --git a/package.json b/package.json index 9440bf54..b6a67a6a 100644 --- a/package.json +++ b/package.json @@ -2,7 +2,7 @@ "author": "Calvin Montgomery", "name": "CyTube", "description": "Online media synchronizer and chat", - "version": "3.34.0", + "version": "3.34.1", "repository": { "url": "http://github.com/calzoneman/sync" }, diff --git a/src/channel/emotes.js b/src/channel/emotes.js index 3cf57737..bb073046 100644 --- a/src/channel/emotes.js +++ b/src/channel/emotes.js @@ -75,7 +75,7 @@ function validateEmote(f) { f.image = f.image.substring(0, 1000); f.image = XSS.sanitizeText(f.image); - var s = XSS.sanitizeText(f.name).replace(/([\\\.\?\+\*\$\^\|\(\)\[\]\{\}])/g, "\\$1"); + var s = XSS.looseSanitizeText(f.name).replace(/([\\\.\?\+\*\$\^\|\(\)\[\]\{\}])/g, "\\$1"); s = "(^|\\s)" + s + "(?!\\S)"; f.source = s; diff --git a/src/xss.js b/src/xss.js index 145d8862..6855db22 100644 --- a/src/xss.js +++ b/src/xss.js @@ -70,6 +70,14 @@ const SETTINGS = { allowedAttributes: ATTRIBUTE_MAP }; +function looseSanitizeText(str) { + str = str.replace(/&/g, "&") + .replace(//g, ">") + .replace(/"/g, """); + return str; +} + function sanitizeText(str) { str = str.replace(/&/g, "&") .replace(/