Fix code scanning alert no. 37: Incomplete multi-character sanitization

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Jonhvmp · Dec 13, 2024 · 10968e8 · 10968e8
1 parent 23112b9
commit 10968e8
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/backend/src/models/Snippet.ts b/backend/src/models/Snippet.ts
@@ -86,7 +86,7 @@ SnippetSchema.pre<ISnippet>('save', function (next) {
 
   // Remover atributos perigosos
   let previousCode;
-  const dangerousAttrRegex = /on\w+=(["'])(?:(?=(\\?))\2.)*?\1/g;
+  const dangerousAttrRegex = /on\w+=(["'])(?:(?=(\\?))\2.)*?\1|javascript:|data:|vbscript:/gi;
   do {
     previousCode = this.code;
     this.code = this.code.replace(dangerousAttrRegex, '');