github
/
layui
mirror of https://github.com/layui/layui
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

fix(form-select): 修复 XSS 漏洞 (#1813)

pull/1828/head
morning-star 2024-04-22 17:21:45 +08:00 committed by GitHub
parent 747c786040
commit b94811ec09
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 7 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
src/modules/form.js
View File

@ -654,14 +654,13 @@ layui.define(['lay', 'layer', 'util'], function(exports){
if(hasEquals){ if(hasEquals){
dl.children('.' + CREATE_OPTION).remove(); dl.children('.' + CREATE_OPTION).remove();
}else{ }else{
// 和初始渲染保持行为一致
var textVal = $('<div>' + value +'</div>').text();
var createOptionElem = dl.children('.' + CREATE_OPTION); var createOptionElem = dl.children('.' + CREATE_OPTION);
if(createOptionElem[0]){ if(createOptionElem[0]){
createOptionElem.attr('lay-value', value); createOptionElem.attr('lay-value', value).html(util.escape(value));
createOptionElem.text(textVal);
}else{ }else{
dl.append('<dd class="' + CREATE_OPTION + '" lay-value="'+ value +'">' + textVal + '</dd>'); var ddElem = $('<dd>');
ddElem.addClass(CREATE_OPTION).attr('lay-value', value).html(util.escape(value));
dl.append(ddElem);
} }
} }
}else{ }else{
@ -722,7 +721,9 @@ layui.define(['lay', 'layer', 'util'], function(exports){
if(isCreatable && othis.hasClass(CREATE_OPTION)){ if(isCreatable && othis.hasClass(CREATE_OPTION)){
othis.removeClass(CREATE_OPTION); othis.removeClass(CREATE_OPTION);
select.append('<option value="' + value + '">' + value + '</option>'); var optionElem = $('<option>');
optionElem.attr('value', value).text(othis.text());
select.append(optionElem);
} }
othis.siblings().removeClass(THIS); othis.siblings().removeClass(THIS);