@capillarytech/cap-ui-utils 3.0.14 → 3.0.15

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/package.json +1 -1
  2. package/utils/contentSanitizationHelper.js +7 -0
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@capillarytech/cap-ui-utils",
3
- "version": "3.0.14",
3
+ "version": "3.0.15",
4
4
  "description": "Utility functions shared accross all the modules",
5
5
  "main": "index.js",
6
6
  "scripts": {
package/utils/contentSanitizationHelper.js CHANGED
@@ -83,9 +83,16 @@ const sanitizeTemplateWithRegexp = (content) => {
83
83
  );
84
84
  // regex to replace the &#39 (ascii html for apostrophe) to the apostrophe for ckeditor content
85
85
  const apostropheRegex = new RegExp(''', 'gi');
86
+ // Preserve double-quote numeric HTML entities by converting them to a raw "
87
+ // BEFORE hexCodeRegex/regexForUnicode strips all &#…; entities. Mirrors the
88
+ // existing apostrophe handling above. " is harmless on its own — XSS bypass
89
+ // tricks like javascript: are still neutralized below because they
90
+ // depend on entities OTHER than "/".
91
+ const quoteEntityRegex = new RegExp('"|"', 'gi');
86
92
 
87
93
  content = content
88
94
  .replaceAll(apostropheRegex, '\'')
95
+ .replaceAll(quoteEntityRegex, '"')
89
96
  .replace(hexCodeRegex, "")
90
97
  .replace(encodedScriptTagRegex, "")
91
98
  .replace(fullTagRegex, "")