fix: fix xss problem when render iframe

msgbyte · Nov 23, 2024 · c1365f2 · c1365f2
1 parent d57a878
commit c1365f2
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/client/web/src/components/Markdown/render.tsx b/client/web/src/components/Markdown/render.tsx
@@ -46,6 +46,11 @@ export const Markdown: React.FC<{
       ),
       iframe: (props) => {
         let src = props.src;
+
+        if (src?.includes('javascript')) {
+          return <div>not support run javascript</div>;
+        }
+
         if (src && src.includes('?')) {
           src += '&autoplay=0'; // make sure media autoplay is false
         }