Marked xss 79060

.gitignore

@@ -17,10 +17,11 @@ src/**.js.map
 !public/cui_fylr.css
 !public/cui_debug.css
 !public/cui-tutorial.js
+!public/worker-*.js
 !demo/public/cui-demo.js
 !demo/public/cui-demo.css
 !demo/public/css
 coverage/*
 *.map
 _obsolete.scss
-.node-version
+.node-version

package.json

@@ -9,7 +9,7 @@
     "build:all": "npm run rmdist && npm run gulp && webpack --progress --env development=true --env all=true && webpack --progress --env production=true --env all=true",
     "build:min": "npm run build:production",
     "build:docs": "node_modules/coffee-script/bin/coffee GenerateDocs.coffee",
-    "test": "jest",
+    "test": "echo \"tests wouldn’t run in jest. jest was removed but tests are kept in case anyone wants to make them work again.\"",
     "rmdist": "rimraf public/*",
     "gulp": "gulp svgstore thirdparty"
   },
@@ -33,55 +33,51 @@
     "url": "https://github.com/programmfabrik/coffeescript-ui/issues"
   },
   "homepage": "https://github.com/programmfabrik/coffeescript-ui#readme",
+  "dependencies": {
+    "ace-builds": "^1.44.0",
+    "coordinate-parser": "^1.0.7",
+    "formatcoords": "^1.1.3",
+    "font-awesome": "^4.7.0",
+    "email-addresses": "^5.0.0",
+    "load-google-maps-api": "^1.3.3",
+    "moment": "^2.30.1",
+    "moment-timezone": "^0.6.2",
+    "marked": "^18.0.5",
+    "dompurify": "3.4.12"
+  },
   "devDependencies": {
-    "ace-builds": "^1.4.14",
-    "autoprefixer": "^10.4.21",
-    "babel-jest": "^21.2.0",
-    "base64-inline-loader": "^2.0.1",
+    "autoprefixer": "^10.5.3",
     "cheerio": "^1.0.0",
     "chokidar": "^4.0.3",
     "clean-webpack-plugin": "^4.0.0",
     "codo": "^2.1.2",
     "coffee-loader": "0.9.0",
     "coffeescript": "^1.12.7",
-    "coordinate-parser": "^1.0.7",
     "css-loader": "^7.1.2",
     "cssnano": "^7.0.7",
-    "email-addresses": "^5.0.0",
-    "file-loader": "^5.1.0",
-    "formatcoords": "^1.1.3",
     "gulp": "^5.0.0",
     "gulp-copy": "^5.0.0",
     "gulp-rename": "^1.4.0",
     "gulp-svgmin": "^4.1.0",
     "gulp-svgstore": "^9.0.0",
-    "hard-source-webpack-plugin": "^0.13.1",
-    "html-loader": "^0.5.1",
-    "jest": "^21.2.1",
+    "html-loader": "^5.1.0",
     "leaflet": "^1.7.1",
     "leaflet-defaulticon-compatibility": "^0.1.2",
-    "load-google-maps-api": "^1.3.3",
-    "marked": "^0.7.0",
     "mini-css-extract-plugin": "^2.7.5",
-    "moment": "^2.29.1",
     "postcss-loader": "^8.1.1",
     "raw-loader": "^4.0.2",
     "resolve-url-loader": "^5.0.0",
-    "rimraf": "^3.0.2",
+    "rimraf": "^6.1.3",
     "sass": "^1.86.0",
     "sass-loader": "^16.0.5",
-    "style-loader": "^1.1.3",
     "stylelint": "^16.19.1",
     "stylelint-config-standard-scss": "^15.0.0",
     "stylelint-webpack-plugin": "^5.0.1",
     "terser-webpack-plugin": "^5.3.7",
     "through2": "^0.6.5",
     "vinyl": "^3.0.0",
-    "webpack": "^5.76.3",
-    "webpack-cli": "^5.0.1"
-  },
-  "dependencies": {
-    "font-awesome": "^4.7.0",
-    "moment-timezone": "^0.5.33"
+    "webpack": "^5.108.4",
+    "webpack-cli": "^5.0.1",
+    "copy-webpack-plugin": "^14.0.0"
   }
 }

src/base/CUI.coffee

@@ -11,7 +11,7 @@
 # @example Startup
 #
 
-marked = require('marked')
+{ marked, Renderer } = require('marked')
 
 class CUI
 
@@ -1016,13 +1016,8 @@ CUI.ready =>
 			document.body.classList.add("cui-browser-"+k)
 
 	CUI.defaults.marked_opts =
-		renderer: new marked.Renderer()
 		gfm: true
-		tables: true
-		breaks: false
-		pedantic: false
-		smartLists: true
-		smartypants: false
+		renderer: new Renderer()
 
 	# initialize a markdown renderer
 	marked.setOptions(CUI.defaults.marked_opts)

src/base/util.coffee

@@ -7,7 +7,7 @@
 CoordinatesParser = require('coordinate-parser');
 CoordinatesFormat = require('formatcoords');
 
-marked = require('marked')
+{ marked } = require('marked')
 moment = require('moment')
 
 class CUI.util
@@ -687,14 +687,8 @@ class CUI.util
 CUI.util.moment = moment
 CUI.util.marked = marked
 
-String.prototype.startsWith = (s) ->
-	@substr(0, s.length) == s
-
 String.prototype.startsWithIgnoreCase = (s) ->
 	@toUpperCase().startsWith(s.toUpperCase())
 
-String.prototype.endsWith = (s) ->
-	@substr(@length-s.length) == s
-
-RegExp.escape= (s) ->
-    s.replace(/[-\/\\^$*+?.()|[\]{}]/g, '\\$&')
+RegExp.escape = (s) ->
+	s.replace(/[-\/\\^$*+?.()|[\]{}]/g, '\\$&')

src/elements/DocumentBrowser/DocumentBrowser.coffee

@@ -5,7 +5,8 @@
  * https://github.com/programmfabrik/coffeescript-ui, http://www.coffeescript-ui.org
 ###
 
-marked = require('marked')
+{ marked, Renderer } = require('marked')
+DOMPurify = require("dompurify")
 
 class CUI.DocumentBrowser extends CUI.Element
 
@@ -43,13 +44,14 @@ class CUI.DocumentBrowser extends CUI.Element
 		@__marked_opts = CUI.util.copyObject(@_marked_opts)
 
 		if not @__marked_opts.renderer
-			@__marked_opts.renderer = new marked.Renderer()
+			@__marked_opts.renderer = new Renderer()
+
 		renderer = @__marked_opts.renderer
 
-		renderer.image = (href, title, text) =>
+		renderer.image = ({ href, title, text }) =>
 			@__node.rendererImage(href, title, text)
 
-		renderer.link = (href, title, text) =>
+		renderer.link = ({ href, title, text }) =>
 			@__node.rendererLink(href, title, text)
 
 		@__words = {}
@@ -60,7 +62,7 @@ class CUI.DocumentBrowser extends CUI.Element
 	marked: (@__node, markdown) ->
 		dfr = new CUI.Deferred()
 		mark = (markdown) =>
-			dfr.resolve(marked(markdown, @__marked_opts))
+			dfr.resolve(DOMPurify.sanitize(marked(markdown, @__marked_opts)))
 		ret = @_getMarkdown(markdown)
 		if CUI.util.isPromise(ret)
 			ret

src/elements/Input/CodeInput.coffee

@@ -24,10 +24,9 @@ class CUI.CodeInput extends CUI.Input
 		super()
 
 		@__aceEditor = Ace.edit(@__input,
-			useWorker: false
+			mode: "ace/mode/#{@_mode}"
 			selectionStyle: "text"
 		)
-		@__aceEditor.getSession().setMode("ace/mode/#{@_mode}");
 
 		value = @__data?[@_name]
 		if value

src/elements/Label/Label.coffee

@@ -5,7 +5,9 @@
  * https://github.com/programmfabrik/coffeescript-ui, http://www.coffeescript-ui.org
 ###
 
-marked = require('marked')
+{ marked } = require('marked')
+DOMPurify = require("dompurify")
+
 CUI.Template.loadTemplateText(require('./Label.html'));
 
 # @param [Object] options for {Label} creation
@@ -139,6 +141,9 @@ class CUI.Label extends CUI.DOMElement
 				check: Boolean
 			markdown_opts:
 				check: "PlainObject"
+			sanitizeMarkdown:
+				check: Boolean
+				default: true
 			tooltip:
 				check: "PlainObject"
 			group:
@@ -191,7 +196,9 @@ class CUI.Label extends CUI.DOMElement
 		if CUI.util.isEmpty(@__currentText)
 			@empty("content")
 		else if markdown
-			@setContent(CUI.dom.htmlToNodes(marked(@__currentText, @__markdown_opts)))
+			renderedMarkdown = marked(@__currentText, @__markdown_opts)
+			htmlValue = if @_sanitizeMarkdown then DOMPurify.sanitize(renderedMarkdown) else renderedMarkdown
+			@setContent(CUI.dom.htmlToNodes(htmlValue))
 			@addClass("cui-label-markdown")
 		else if @_text_node_func
 			@setContent(@_text_node_func(@__currentText))

src/elements/MarkdownInput/MarkdownInput.coffee

@@ -5,7 +5,8 @@
  * https://github.com/programmfabrik/coffeescript-ui, http://www.coffeescript-ui.org
 ###
 
-marked = require('marked')
+{ marked } = require('marked')
+DOMPurify = require("dompurify")
 
 class CUI.MarkdownInput extends CUI.Input
 	initOpts: ->
@@ -215,7 +216,7 @@ class CUI.MarkdownInput extends CUI.Input
 		@__preview.innerHTML = @renderHTML()
 
 	renderHTML: ->
-		@_renderFunction(@getElement().value)
+		DOMPurify.sanitize(@_renderFunction(@getElement().value))
 
 	@__escape_regexp: new RegExp('[\\'+('*-_\\![]()'.split("").join("\\"))+']','g')