[frontend] Override default knockout html binding to prevent XSS
return result;
};
+ // we override the default html binding to prevent XSS/JS injection
+ var originalHtmlBinding = ko.bindingHandlers.html;
+ ko.bindingHandlers.html = {
+ init: function (element, valueAccessor, allBindings, viewModel, bindingContext) {
+ var newValueAccessor = function () {
+ return hueUtils.deXSS(ko.unwrap(valueAccessor()));
+ };
+ originalHtmlBinding.init(element, newValueAccessor, allBindings, viewModel, bindingContext);
+ },
+ update: function (element, valueAccessor, allBindings, viewModel, bindingContext) {
+ var newValueAccessor = function () {
+ return hueUtils.deXSS(ko.unwrap(valueAccessor()));
+ };
+ originalHtmlBinding.update(element, newValueAccessor, allBindings, viewModel, bindingContext);
+ },
+ };
+
ko.observableDefault = function () {
var prop = arguments[0], defvalue = arguments[1] || null;
return ko.observable(typeof prop != "undefined" && prop != null ? prop : defvalue);
