Merge branch 'pr/1402' into dev

llaske · Sep 1, 2023 · 380ef1e · 380ef1e
2 parents 4a98d59 + 974b980
commit 380ef1e
Show file tree

Hide file tree

Showing 3 changed files with 4 additions and 3 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -26,6 +26,7 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 - QR activity Photo Loading Icon Overlaping #1268
 - Fototoon Activity: interactive buttons appears under the box shape #1221
 - "Help" pop-ups nearly impossible to close in Chrome on Mobile #1403
+- XSS injections on Labyrinth JS and Paint Activity #787
 
 ## [1.7.0] - 2023-03-28
 ### Added

diff --git a/activities/LabyrinthJS.activity/js/activity.js b/activities/LabyrinthJS.activity/js/activity.js
@@ -538,7 +538,7 @@ define(["sugar-web/activity/activity", "webL10n", "sugar-web/datastore", "sugar-
 		// HACK: dynamically compute need size putting the string in a hidden div element
 		var computeStringSize = function(text, fontfamily, fontsize, bold, italic) {
 			var computer = document.getElementById("fontsizecomputer");
-			computer.innerHTML = text.replace("<","&lt;").replace(">","&gt;");
+			computer.innerText = text;
 			computer.style.fontFamily = fontfamily;
 			computer.style.fontSize = fontsize+"px";
 			if (bold) computer.style.fontWeight = "bold";

diff --git a/activities/Paint.activity/js/modes/modes-text.js b/activities/Paint.activity/js/modes/modes-text.js
@@ -28,7 +28,7 @@ define([], function () {
 
       /* We create a floating element with the text where the user clicked */
       var element = document.createElement('span');
-      element.innerHTML = text;
+      element.innerText = text;
       element.style.position = 'absolute';
       element.style.padding = '0px';
       element.size = text.length + 1;
@@ -86,7 +86,7 @@ define([], function () {
         return;
       }
 
-      var txt = PaintApp.data.currentElement.element.innerHTML;
+      var txt = PaintApp.data.currentElement.element.innerText;
       var top = PaintApp.data.currentElement.element.getBoundingClientRect().top - 55 + PaintApp.data.currentElement.element.getBoundingClientRect().height;
 
       /* We draw the text inside the canvas */