Skip to content

Commit

Permalink
Edge: Safeguard content before writing it to the DOM via javascript
Browse files Browse the repository at this point in the history
Using ` (template literals) to 'quote' the string is not safe.

Use ' (regular string literal) intead and escape the data properly.
  • Loading branch information
sratz committed Sep 12, 2024
1 parent d271060 commit 341418b
Showing 1 changed file with 8 additions and 1 deletion.
Original file line number Diff line number Diff line change
Expand Up @@ -735,7 +735,7 @@ int handleDOMContentLoaded(long pView, long pArgs) {
return COM.S_OK;
});
webView.ExecuteScript(
stringToWstr("document.open(); document.write(`" + lastCustomText + "`); document.close();"),
stringToWstr("document.open(); document.write('" + escapeForSingleQuotedJSString(lastCustomText) + "'); document.close();"),
postExecute);
postExecute.Release();
this.lastCustomText = null;
Expand All @@ -746,6 +746,13 @@ int handleDOMContentLoaded(long pView, long pArgs) {
return COM.S_OK;
}

private static String escapeForSingleQuotedJSString(String str) {
return str.replace("\\", "\\\\") //
.replace("'", "\\'") //
.replace("\r", "\\r") //
.replace("\n", "\\n");
}

int handleContextMenuRequested(long pView, long pArgs) {
ICoreWebView2ContextMenuRequestedEventArgs args = new ICoreWebView2ContextMenuRequestedEventArgs(pArgs);

Expand Down

0 comments on commit 341418b

Please sign in to comment.