Browse Source

Prevents form submission in diagram preview

https://huntr.dev/bounties/2a0b76a9-e463-4368-91fd-d10590bde03d/
David Benson 3 years ago
parent
commit
65f9865f8b
1 changed files with 1 additions and 1 deletions
  1. 1 1
      src/main/webapp/js/grapheditor/Graph.js

+ 1 - 1
src/main/webapp/js/grapheditor/Graph.js

@@ -1663,7 +1663,7 @@ Graph.removePasteFormatting = function(elt)
  */
 Graph.sanitizeHtml = function(value, editing)
 {
-	return DOMPurify.sanitize(value, {ADD_ATTR: ['target'],
+	return DOMPurify.sanitize(value, {ADD_ATTR: ['target'], FORBID_TAGS: ['form'],
 		ALLOWED_URI_REGEXP: /^(?:(?:(?:f|ht)tps?|mailto|tel|callto|cid|xmpp|data):|[^a-z]|[a-z+.\-]+(?:[^a-z+.\-:]|$))/i});
 };