Update from to-markdown to turndown
We got a security alert for a regular expression DoS attack on our used library `to-markdown`. After checking `to-markdown` to be maintained or not, it turned out they renamed the library to `turndown`. So upgrading to `turndown` should fix this vulnerbility. References: https://www.npmjs.com/package/to-markdown https://github.com/domchristie/turndown/wiki/Migrating-from-to-markdown-to-Turndown Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
This commit is contained in:
@@ -12,7 +12,7 @@ require('../css/site.css')
|
||||
|
||||
require('highlight.js/styles/github-gist.css')
|
||||
|
||||
import toMarkdown from 'to-markdown'
|
||||
import TurndownService from 'turndown'
|
||||
|
||||
import { saveAs } from 'file-saver'
|
||||
import randomColor from 'randomcolor'
|
||||
@@ -1498,7 +1498,12 @@ $('#snippetExportModalConfirm').click(function () {
|
||||
})
|
||||
|
||||
function parseToEditor (data) {
|
||||
var parsed = toMarkdown(data)
|
||||
var turndownService = new TurndownService({
|
||||
defaultReplacement: function (innerHTML, node) {
|
||||
return node.isBlock ? '\n\n' + node.outerHTML + '\n\n' : node.outerHTML
|
||||
}
|
||||
})
|
||||
var parsed = turndownService.turndown(data)
|
||||
if (parsed) { replaceAll(parsed) }
|
||||
}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user