mirror of
https://github.com/duckietm/Nitro-V3.git
synced 2026-06-19 15:06:20 +00:00
simoleo89
301294ecf4
Several dangerouslySetInnerHTML sinks rendered user-controlled strings (chat messages, usernames, chat history) without sanitisation, relying implicitly on upstream formatting or server-side charset limits. Route them all through the existing SanitizeHtml (DOMPurify) helper so the security guarantee is local to each render site. Sinks fixed: ChatWidgetWindowView (name/message/original/translated), ChatHistoryView (name/message), AvatarInfoWidgetNameView + AvatarInfoWidgetAvatarView (username), SelectReportedUserView (username). Add regression suites: SanitizeHtml.test.ts (XSS neutralised, chat markup preserved) and RoomChatFormatter.test.ts (pins the existing encodeHTML defence). No behaviour change: SanitizeHtml's allow-list keeps the b/i/u/span/strong/em/br markup the chat/profile UI relies on.
31 lines
1.1 KiB
TypeScript
31 lines
1.1 KiB
TypeScript
import { GetSessionDataManager } from '@nitrots/nitro-renderer';
|
|
import { FC, useMemo } from 'react';
|
|
import { AvatarInfoName, SanitizeHtml } from '../../../../../api';
|
|
import { ContextMenuView } from '../../context-menu/ContextMenuView';
|
|
|
|
interface AvatarInfoWidgetNameViewProps
|
|
{
|
|
nameInfo: AvatarInfoName;
|
|
onClose: () => void;
|
|
}
|
|
|
|
export const AvatarInfoWidgetNameView: FC<AvatarInfoWidgetNameViewProps> = props =>
|
|
{
|
|
const { nameInfo = null, onClose = null } = props;
|
|
|
|
const getClassNames = useMemo(() =>
|
|
{
|
|
const newClassNames: string[] = [ 'name-only' ];
|
|
|
|
if(nameInfo.isFriend) newClassNames.push('is-friend');
|
|
|
|
return newClassNames;
|
|
}, [ nameInfo ]);
|
|
|
|
return (
|
|
<ContextMenuView category={ nameInfo.category } classNames={ getClassNames } fades={ (nameInfo.id !== GetSessionDataManager().userId) } objectId={ nameInfo.roomIndex } userType={ nameInfo.userType } onClose={ onClose }>
|
|
<div className="text-shadow" dangerouslySetInnerHTML={ { __html: SanitizeHtml(`${ nameInfo.name }`) } }></div>
|
|
</ContextMenuView>
|
|
);
|
|
};
|