keeweb
/
keeweb-plugins
mirror of https://github.com/keeweb/keeweb-plugins.git
1
0
Fork 0
Code Issues Releases Wiki Activity

fixed possible XSS breaches

This commit is contained in:
leolivier 2018-03-19 22:03:13 +01:00
parent 573f6583d8
commit fef98fd29a
1 changed files with 5 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
docs/plugins/haveibeenpwned/plugin.js
View File

@ -9,8 +9,9 @@ const Alerts = require('comp/alerts');
const Logger = require('util/logger');
const InputFx = require('util/input-fx');
const Kdbxweb = require('kdbxweb');
const detailsViewFieldChanged = DetailsView.prototype.fieldChanged;
const _ = require('_');
const detailsViewFieldChanged = DetailsView.prototype.fieldChanged;
const settings = { checkPwnedPwd: false, checkPwnedName: false, blockPwnedPwd: false, blockPwnedName: false };
const logger = new Logger('HaveIBeenPwned');
@ -121,7 +122,7 @@ DetailsView.prototype.checkNamePwned = function (name) {
if (data && data.length > 0) {
logger.info('found breaches ' + JSON.stringify(data));
let breaches = '';
data.forEach(breach => { breaches += `<li>${breach.Name}</li>\n`; });
data.forEach(breach => { breaches += '<li>' + _.escape(breach.Name) + '</li>\n'; });
hibp.alert(`WARNING! This account has been pawned in the following breaches<br/>\n<ul>\n${breaches}\n</ul>\n<p>Please check on <a href='https://haveibeenpwned.com'>https://haveibeenpwned.com</a>\n`);
this.userEditView.$el.focus();
this.userEditView.$el.addClass('input--error');
@ -154,8 +155,9 @@ DetailsView.prototype.checkPwdPwned = function (passwordHash) {
logger.info('found breaches ' + JSON.stringify(data));
data.split('\r\n').forEach(line => {
const h = line.split(':');
const suffix = h[0]; const nb = h[1];
const suffix = h[0];
if (prefix + suffix === passwordHash) {
const nb = _.escape(h[1]);
hibp.alert(`WARNING: This password is referenced as pawned ${nb} times on <a href='https://haveibeenpwned.com'>https://haveibeenpwned.com</a>!\n`);
this.passEditView.$el.focus();
this.passEditView.$el.addClass('input--error');