fix(editor): Prevent clipboard XSS injection #10805
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
n8n-assistant
bot
added
n8n team
tomi
reviewed
Sep 13, 2024
| @@ -37,6 +37,13 @@ export function sanitizeHtml(dirtyHtml: string) { | |||
| return sanitizedHtml; | |||
| } | |||
|
|
|||
| export const sanitizeInput = <T>(message: T): string | T => { | |||
There was a problem hiding this comment.
Maybe this could be named sanitizeInputIfNeeded or sanitizeIfString to indicate that it conditionally sanitizes the input. Also a JSDoc comment would be nice (e.g. what does sanitize mean in this case) 🙏
There was a problem hiding this comment.
@tomi done! let me know if you had something different in mind
tomi
approved these changes
Sep 13, 2024
n8n
|
||||||||||||||||||||||||||||
| Project |
n8n
|
| Branch Review |
sec-119-xss-vulnerability-when-pasting-into-canvas
|
| Run status |
|
| Run duration | 04m 37s |
| Commit |
|
| Committer | r00gm |
| View all properties for this run ↗︎ | |
| Test results | |
|---|---|
Failures
|
0
|
Flaky
|
0
|
Pending
|
0
|
Skipped
|
0
|
Passing
|
429
|
| View all changes introduced in this branch ↗︎ | |
|
✅ All Cypress E2E specs passed |
r00gm
deleted the
sec-119-xss-vulnerability-when-pasting-into-canvas
branch
MiloradFilipovic
added a commit
that referenced
this pull request
Sep 17, 2024
* master: refactor(core): Set up worker server (#10814) fix(Google Vertex Chat Model Node): Clean service account private key (#10770) test(core): Mock filesystem in tests (#10823) test(core): Fix license mock in worker test (#10824) ci: Ignore certain paths for e2e tests for PRs (no-changelog) (#10533) fix(editor): Render image binary-data using img tags (#10829) refactor(core): Move `instanceType` to `InstanceSettings` (no-changelog) (#10640) ci(benchmark): Always perform az login before teardown (#10827) fix: Prevent copying workflow when copying outside of canvas (#10813) fix: Fix telemetry causing console error (#10828) refactor: Remove unused disable directives from `nodes-base` (#10825) refactor(core): Remove unused disable directives from backend packages (#10826) chore: Upgrade to TypeScript 5.6 (#10822) fix(editor): Prevent clipboard XSS injection (#10805) refactor(core): Simplify createDeferredPromise, and add tests (no-changelog) (#10811) fix(HTTP Request Tool Node): Fix subsequent tool calls reusung the same options (#10808) fix(editor): Make expression edit modal read-only in executions view (#10806) refactor(core): Move push message types to a new shared package (no-changelog) (#10742) fix(editor): Make schema view search copy more clear (#10807)
Merged
|
Got released with |
riascho
pushed a commit
that referenced
this pull request
Sep 23, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
Related Linear tickets, Github issues, and Community forum posts
https://linear.app/n8n/issue/SEC-119/xss-vulnerability-when-pasting-into-canvas
Review / Merge checklist
release/backport(if the PR is an urgent fix that needs to be backported)