github/svgedit
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

useEncodeURIComponent to add security to dynamic import

Browse Source
This commit is contained in:
jfh
2020-10-05 21:27:48 +02:00
parent d8a8869b98
commit 6d1c36b6d3
22 changed files with 30 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
.eslintrc.js
View File

@@ -124,7 +124,14 @@ module.exports = {
'node/no-unsupported-features/node-builtins': 'warn',
'prefer-exponentiation-operator': 'warn',
'node/no-unsupported-features/es-syntax': 'off',
'no-unsanitized/method': 'off'
'no-unsanitized/method': [
'error',
{
escape: {
methods: ['encodeURIComponent', 'encodeURI']
}
}
]
},
overrides: [
// Locales have no need for importing outside of SVG-Edit

2
src/editor/extensions/ext-arrows/ext-arrows.js
View File

@@ -10,7 +10,7 @@
const loadExtensionTranslation = async function (lang) {
let translationModule;
try {
translationModule = await import(`./locale/${lang}.js`);
translationModule = await import(`./locale/${encodeURIComponent(lang)}.js`);
} catch (_error) {
// eslint-disable-next-line no-console
console.error(`Missing translation (${lang}) - using 'en'`);

2
src/editor/extensions/ext-closepath/ext-closepath.js
View File

@@ -10,7 +10,7 @@
const loadExtensionTranslation = async function (lang) {
let translationModule;
try {
translationModule = await import(`./locale/${lang}.js`);
translationModule = await import(`./locale/${encodeURIComponent(lang)}.js`);
} catch (_error) {
// eslint-disable-next-line no-console
console.error(`Missing translation (${lang}) - using 'en'`);

2
src/editor/extensions/ext-connector/ext-connector.js
View File

@@ -10,7 +10,7 @@
const loadExtensionTranslation = async function (lang) {
let translationModule;
try {
translationModule = await import(`./locale/${lang}.js`);
translationModule = await import(`./locale/${encodeURIComponent(lang)}.js`);
} catch (_error) {
// eslint-disable-next-line no-console
console.error(`Missing translation (${lang}) - using 'en'`);

2
src/editor/extensions/ext-eyedropper/ext-eyedropper.js
View File

@@ -10,7 +10,7 @@
const loadExtensionTranslation = async function (lang) {
let translationModule;
try {
translationModule = await import(`./locale/${lang}.js`);
translationModule = await import(`./locale/${encodeURIComponent(lang)}.js`);
} catch (_error) {
// eslint-disable-next-line no-console
console.error(`Missing translation (${lang}) - using 'en'`);

2
src/editor/extensions/ext-foreignobject/ext-foreignobject.js
View File

@@ -10,7 +10,7 @@
const loadExtensionTranslation = async function (lang) {
let translationModule;
try {
translationModule = await import(`./locale/${lang}.js`);
translationModule = await import(`./locale/${encodeURIComponent(lang)}.js`);
} catch (_error) {
// eslint-disable-next-line no-console
console.error(`Missing translation (${lang}) - using 'en'`);

2
src/editor/extensions/ext-grid/ext-grid.js
View File

@@ -10,7 +10,7 @@
const loadExtensionTranslation = async function (lang) {
let translationModule;
try {
translationModule = await import(`./locale/${lang}.js`);
translationModule = await import(`./locale/${encodeURIComponent(lang)}.js`);
} catch (_error) {
// eslint-disable-next-line no-console
console.error(`Missing translation (${lang}) - using 'en'`);

2
src/editor/extensions/ext-helloworld/ext-helloworld.js
View File

@@ -16,7 +16,7 @@
const loadExtensionTranslation = async function (lang) {
let translationModule;
try {
translationModule = await import(`./locale/${lang}.js`);
translationModule = await import(`./locale/${encodeURIComponent(lang)}.js`);
} catch (_error) {
// eslint-disable-next-line no-console
console.error(`Missing translation (${lang}) - using 'en'`);

2
src/editor/extensions/ext-imagelib/ext-imagelib.js
View File

@@ -10,7 +10,7 @@
const loadExtensionTranslation = async function (lang) {
let translationModule;
try {
translationModule = await import(`./locale/${lang}.js`);
translationModule = await import(`./locale/${encodeURIComponent(lang)}.js`);
} catch (_error) {
// eslint-disable-next-line no-console
console.error(`Missing translation (${lang}) - using 'en'`);

2
src/editor/extensions/ext-markers/ext-markers.js
View File

@@ -32,7 +32,7 @@
const loadExtensionTranslation = async function (lang) {
let translationModule;
try {
translationModule = await import(`./locale/${lang}.js`);
translationModule = await import(`./locale/${encodeURIComponent(lang)}.js`);
} catch (_error) {
// eslint-disable-next-line no-console
console.error(`Missing translation (${lang}) - using 'en'`);

2
src/editor/extensions/ext-mathjax/ext-mathjax.js
View File

@@ -11,7 +11,7 @@
const loadExtensionTranslation = async function (lang) {
let translationModule;
try {
translationModule = await import(`./locale/${lang}.js`);
translationModule = await import(`./locale/${encodeURIComponent(lang)}.js`);
} catch (_error) {
// eslint-disable-next-line no-console
console.error(`Missing translation (${lang}) - using 'en'`);

2
src/editor/extensions/ext-panning/ext-panning.js
View File

@@ -13,7 +13,7 @@
const loadExtensionTranslation = async function (lang) {
let translationModule;
try {
translationModule = await import(`./locale/${lang}.js`);
translationModule = await import(`./locale/${encodeURIComponent(lang)}.js`);
} catch (_error) {
// eslint-disable-next-line no-console
console.error(`Missing translation (${lang}) - using 'en'`);

2
src/editor/extensions/ext-placemark/ext-placemark.js
View File

@@ -9,7 +9,7 @@
const loadExtensionTranslation = async function (lang) {
let translationModule;
try {
translationModule = await import(`./locale/${lang}.js`);
translationModule = await import(`./locale/${encodeURIComponent(lang)}.js`);
} catch (_error) {
// eslint-disable-next-line no-console
console.error(`Missing translation (${lang}) - using 'en'`);

2
src/editor/extensions/ext-polygon/ext-polygon.js
View File

@@ -9,7 +9,7 @@
const loadExtensionTranslation = async function (lang) {
let translationModule;
try {
translationModule = await import(`./locale/${lang}.js`);
translationModule = await import(`./locale/${encodeURIComponent(lang)}.js`);
} catch (_error) {
// eslint-disable-next-line no-console
console.error(`Missing translation (${lang}) - using 'en'`);

2
src/editor/extensions/ext-server_moinsave/ext-server_moinsave.js
View File

@@ -12,7 +12,7 @@ import {Canvg as canvg} from 'canvg';
const loadExtensionTranslation = async function (lang) {
let translationModule;
try {
translationModule = await import(`./locale/${lang}.js`);
translationModule = await import(`./locale/${encodeURIComponent(lang)}.js`);
} catch (_error) {
// eslint-disable-next-line no-console
console.error(`Missing translation (${lang}) - using 'en'`);

2
src/editor/extensions/ext-server_opensave/ext-server_opensave.js
View File

@@ -11,7 +11,7 @@ import {Canvg as canvg} from 'canvg';
const loadExtensionTranslation = async function (lang) {
let translationModule;
try {
translationModule = await import(`./locale/${lang}.js`);
translationModule = await import(`./locale/${encodeURIComponent(lang)}.js`);
} catch (_error) {
// eslint-disable-next-line no-console
console.error(`Missing translation (${lang}) - using 'en'`);

2
src/editor/extensions/ext-shapes/ext-shapes.js
View File

@@ -10,7 +10,7 @@
const loadExtensionTranslation = async function (lang) {
let translationModule;
try {
translationModule = await import(`./locale/${lang}.js`);
translationModule = await import(`./locale/${encodeURIComponent(lang)}.js`);
} catch (_error) {
// eslint-disable-next-line no-console
console.error(`Missing translation (${lang}) - using 'en'`);

2
src/editor/extensions/ext-star/ext-star.js
View File

@@ -9,7 +9,7 @@
const loadExtensionTranslation = async function (lang) {
let translationModule;
try {
translationModule = await import(`./locale/${lang}.js`);
translationModule = await import(`./locale/${encodeURIComponent(lang)}.js`);
} catch (_error) {
// eslint-disable-next-line no-console
console.error(`Missing translation (${lang}) - using 'en'`);

2
src/editor/extensions/ext-storage/ext-storage.js
View File

@@ -22,7 +22,7 @@
const loadExtensionTranslation = async function (lang) {
let translationModule;
try {
translationModule = await import(`./locale/${lang}.js`);
translationModule = await import(`./locale/${encodeURIComponent(lang)}.js`);
} catch (_error) {
// eslint-disable-next-line no-console
console.error(`Missing translation (${lang}) - using 'en'`);

2
src/editor/extensions/ext-webappfind/ext-webappfind.js
View File

@@ -9,7 +9,7 @@
const loadExtensionTranslation = async function (lang) {
let translationModule;
try {
translationModule = await import(`./locale/${lang}.js`);
translationModule = await import(`./locale/${encodeURIComponent(lang)}.js`);
} catch (_error) {
// eslint-disable-next-line no-console
console.error(`Missing translation (${lang}) - using 'en'`);

2
src/editor/locale.js
View File

@@ -357,6 +357,6 @@ export const putLocale = async function (givenParam, goodLangs) {
if (!goodLangs.includes(langParam) && langParam !== 'test') {
langParam = 'en';
}
const module = await import(`./locale/lang.${langParam}.js`);
const module = await import(`./locale/lang.${encodeURIComponent(langParam)}.js`);
return readLang(module.default);
};

4
src/editor/svgedit.js
View File

@@ -783,7 +783,7 @@ editor.init = function () {
/**
* @type {module:SVGEditor.ExtensionObject}
*/
const imported = await import(`./extensions/${extname}/${extname}.js`);
const imported = await import(`./extensions/${encodeURIComponent(extname)}/${encodeURIComponent(extname)}.js`);
const {name = extname, init} = imported.default;
return editor.addExtension(name, (init && init.bind(editor)), {$, langParam});
} catch (err) {
@@ -806,7 +806,7 @@ editor.init = function () {
/**
* @type {module:SVGEditor.ExtensionObject}
*/
const imported = await import(extPathName);
const imported = await import(encodeURI(extPathName));
const {name, init} = imported.default;
return editor.addExtension(name, (init && init.bind(editor)), {$, langParam});
} catch (err) {