mirror/reveal.js
1
0
Fork 0
mirror of https://github.com/hakimel/reveal.js.git synced 2025-04-21 13:01:59 +02:00
Code Issues Releases Wiki Activity

Merge pull request #3548 from hackmdio/fix/xss-on-data-background-video-attribute

Browse Source 
fix: use `setAttribute` instead of `innerHTML` to prevent XSS
This commit is contained in:
Hakim El Hattab 2023-12-15 08:56:55 +01:00 committed by GitHub
commit 767a67ee00
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 6 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
js/controllers/slidecontent.js
View File

@ -142,13 +142,15 @@ export default class SlideContent {
// Support comma separated lists of video sources
backgroundVideo.split( ',' ).forEach( source => {
const sourceElement = document.createElement( 'source' );
sourceElement.setAttribute( 'src', source );
let type = getMimeTypeFromFile( source );
if( type ) {
video.innerHTML += `<source src="${source}" type="${type}">`;
}
else {
video.innerHTML += `<source src="${source}">`;
sourceElement.setAttribute( 'type', type );
}
video.appendChild( sourceElement );
} );
backgroundContent.appendChild( video );