fix: overlay content #3553

snitin315 · 2021-07-22T11:23:06Z

For Bugs and Features; did you add new tests?

Yes

Motivation / Use-Case

Fix #3552

Before

After

Breaking Changes

No

Additional Info

No

alexander-akait · 2021-07-22T11:24:24Z

client-src/overlay.js

@@ -138,7 +137,7 @@ function show(messages, type) {

      // Make it look similar to our terminal.
      const errorMessage = message.message || messages[0];
-      const text = ansiHTML(encode(errorMessage));


It is not safe, here can be XSS

Maybe we need decode(text, {level: 'html5'}) afterwards

hm, maybe, just try it

alexander-akait

Also we need test it

snitin315 · 2021-07-22T12:39:42Z

Also we need test it

WIP on tests

codecov · 2021-07-22T13:35:28Z

Codecov Report

Merging #3553 (c7482d6) into master (9307755) will decrease coverage by 0.47%.
The diff coverage is n/a.

@@            Coverage Diff             @@
##           master    #3553      +/-   ##
==========================================
- Coverage   94.02%   93.55%   -0.48%     
==========================================
  Files          15       15              
  Lines        1256     1256              
  Branches      431      431              
==========================================
- Hits         1181     1175       -6     
- Misses         69       75       +6     
  Partials        6        6

Impacted Files	Coverage Δ
lib/servers/WebsocketServer.js	`91.66% <0.00%> (-5.56%)`	⬇️
lib/utils/DevServerPlugin.js	`97.82% <0.00%> (-2.18%)`	⬇️
lib/Server.js	`93.61% <0.00%> (-0.13%)`	⬇️

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 9307755...c7482d6. Read the comment docs.

snitin315 · 2021-07-22T14:03:08Z

Ready for review. /cc @alexander-akait

alexander-akait · 2021-07-22T14:08:07Z

Thanks, will look at near future

alexander-akait · 2021-07-22T16:21:11Z

I was wrong about XSS due Creates a new Text node. This method can be used to escape HTML characters. https://developer.mozilla.org/en-US/docs/Web/API/Document/createTextNode

alexander-akait · 2021-07-22T16:21:18Z

Fixed, anyway thanks

alexander-akait

Less deps ⭐

joacub · 2021-07-23T01:35:32Z

the correct fix is this ====>

const errorMessage = message.message || messages[0];
const content = ansiHTML(errorMessage);
const messageContentNode = document.createElement('div');
messageContentNode.innerHTML = content;

html still showing bad, with this looks perfect, see the imagen bellow:

alexander-akait · 2021-07-23T10:46:24Z

It is xss, no it is not good

alexander-akait · 2021-07-23T10:47:34Z

Current solution has the same output

joacub · 2021-07-23T15:05:54Z

Current solution has the same output

Impossible, html in a text node will be show up like entities…. 😓😓😓😓
this still wrong....

joacub

Html in text node will appear like <span>raw</span>

alexander-akait · 2021-07-23T16:20:09Z

Please provide screenshot, again, always use the issue template, our tests are fine

joacub · 2021-07-23T16:44:11Z

Please provide screenshot, again, always use the issue template, our tests are fine

Did you test with html content ?

alexander-akait · 2021-07-23T16:45:36Z

We should not accept HTML content from error/warning messages, otherwise you can inject <script> and do XSS

joacub · 2021-07-23T16:45:37Z

Look is very simple, text node can no allocate html only text….

alexander-akait · 2021-07-23T16:45:54Z

Because it is XSS

joacub · 2021-07-23T16:46:17Z

Because it is XSS

Inject xss to my self 🤣

alexander-akait · 2021-07-23T16:47:49Z

other plugin which you can be installed and emit HTML content and steel your environments, it is not joke

joacub · 2021-07-23T16:51:48Z

Perfect, is a 1% of the time that can happen maybe less, there is other solution to show correctly this? cause is impossible to read anything

alexander-akait · 2021-07-23T16:52:58Z

No one plugin should not emit HTML content in warning/error messages

alexander-akait · 2021-07-23T16:53:46Z

In your screenshot only text content and it should be good in overlay

joacub · 2021-07-23T16:53:47Z

No one plugin should not emit HTML content in warning/error messages

Eslint do and do nice and read is bestifully, so best way is disable this not useful overlay

alexander-akait · 2021-07-23T16:54:44Z

Eslint do and do nice and read is bestifully

HTML content? don't talk nonsense, eslint uses only ansi colors (yes, you can write custom output, but I don't see it is good idea), I don't see HTML content

joacub · 2021-07-23T16:58:36Z

Eslint do and do nice and read is bestifully

HTML content? don't talk nonsense, eslint uses only ansi colors (yes, you can write custom output, but I don't see it is good idea), I don't see HTML content

Eslint return html you check in the other issue the screenshot with html …..

alexander-akait · 2021-07-23T17:02:57Z

No HTML in any place

joacub · 2021-07-23T17:03:13Z

Loook this

alexander-akait · 2021-07-23T17:05:15Z

Okay, please open a new issue with reproducible test repo and format this as issue template, original problem with html entries was fixed, what is why I ask ALWAYS use the issue template

alexander-akait reviewed Jul 22, 2021

View reviewed changes

fix: overlay content

8a5d918

snitin315 force-pushed the fix-overlay branch from 9115f23 to 8a5d918 Compare July 22, 2021 12:32

alexander-akait reviewed Jul 22, 2021

View reviewed changes

test: update snapshots

24a3044

snitin315 added 2 commits July 22, 2021 18:18

test: overlay

f95e1a6

test: webpack 4

5a08bad

snitin315 force-pushed the fix-overlay branch from b4a533f to 5a08bad Compare July 22, 2021 13:24

snitin315 marked this pull request as ready for review July 22, 2021 13:59

snitin315 requested review from anshumanv, hiroppy and knagaitsev as code owners July 22, 2021 13:59

snitin315 changed the title ~~[WIP] fix: overlay content~~ fix: overlay content Jul 22, 2021

fix: code

d933f81

test: fix

dbc67ce

alexander-akait approved these changes Jul 22, 2021

View reviewed changes

Merge branch 'master' into fix-overlay

c7482d6

alexander-akait merged commit bec34e7 into master Jul 23, 2021

alexander-akait deleted the fix-overlay branch July 23, 2021 13:28

joacub reviewed Jul 23, 2021

View reviewed changes

webpack locked as resolved and limited conversation to collaborators Jul 23, 2021

Uh oh!

fix: overlay content #3553

fix: overlay content #3553

Uh oh!

Conversation

snitin315 commented Jul 22, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

For Bugs and Features; did you add new tests?

Motivation / Use-Case

Before

After

Breaking Changes

Additional Info

Uh oh!

alexander-akait Jul 22, 2021

Choose a reason for hiding this comment

Uh oh!

snitin315 Jul 22, 2021

Choose a reason for hiding this comment

Uh oh!

alexander-akait Jul 22, 2021

Choose a reason for hiding this comment

Uh oh!

alexander-akait left a comment

Choose a reason for hiding this comment

Uh oh!

snitin315 commented Jul 22, 2021

Uh oh!

codecov bot commented Jul 22, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

snitin315 commented Jul 22, 2021

Uh oh!

alexander-akait commented Jul 22, 2021

Uh oh!

alexander-akait commented Jul 22, 2021

Uh oh!

alexander-akait commented Jul 22, 2021

Uh oh!

alexander-akait left a comment

Choose a reason for hiding this comment

Uh oh!

joacub commented Jul 23, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

alexander-akait commented Jul 23, 2021

Uh oh!

alexander-akait commented Jul 23, 2021

Uh oh!

joacub commented Jul 23, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

joacub left a comment

Choose a reason for hiding this comment

Uh oh!

alexander-akait commented Jul 23, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

joacub commented Jul 23, 2021

Uh oh!

alexander-akait commented Jul 23, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

joacub commented Jul 23, 2021

Uh oh!

alexander-akait commented Jul 23, 2021

Uh oh!

joacub commented Jul 23, 2021

Uh oh!

alexander-akait commented Jul 23, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

joacub commented Jul 23, 2021

Uh oh!

alexander-akait commented Jul 23, 2021

Uh oh!

alexander-akait commented Jul 23, 2021

Uh oh!

joacub commented Jul 23, 2021

snitin315 commented Jul 22, 2021 •

edited

Loading

codecov bot commented Jul 22, 2021 •

edited

Loading

joacub commented Jul 23, 2021 •

edited

Loading

joacub commented Jul 23, 2021 •

edited

Loading

alexander-akait commented Jul 23, 2021 •

edited

Loading

alexander-akait commented Jul 23, 2021 •

edited

Loading

alexander-akait commented Jul 23, 2021 •

edited

Loading

alexander-akait commented Jul 23, 2021 •

edited

Loading