修改跨站脚本攻击缺陷

jero-web/public/ueditor/ADT/background/background.js

@@ -117,6 +117,19 @@
         onlineImage = onlineImage || new OnlineImage('imageList');
     }
 
+    function htmlspecialchars (string) {
+      var entityMap = {
+        '&': '&',
+        '<': '&lt;',
+        '>': '&gt;',
+        '"': '&quot;',
+        "'": '&#39;',
+        '/': '&#x2F;'
+      }
+      return String(string).replace(/[&<>"'\/]/g, function (s) {
+        return entityMap[s]
+      })
+    }
     /* 更新背景色设置面板 */
     function updateFormState (radio, color, url, align, x, y) {
         var nocolorRadio = $G('nocolorRadio'),
@@ -132,7 +145,8 @@
 
         if(url && /^\//.test(url)) {
             var a = document.createElement('a');
-            a.href = url;
+            a.href = htmlspecialchars(url);
+            a.ref= 'nofollow noopener noreferrer'
             browser.ie && (a.href = a.href);
             url = browser.ie ? a.href:(a.protocol + '//' + a.host + a.pathname + a.search + a.hash);
         }

jero-web/public/ueditor/ADT/scrawl/scrawl.html

@@ -53,10 +53,10 @@
             <div id="J_addImg" class="addImgH">
                 <em class="icon"></em>
                 <em class="text"><var id="lang_input_addPic"></var></em>
-                <form method="post" id="fileForm" enctype="multipart/form-data" class="addImgH_form" target="up">
-                    <input type="file" name="upfile" id="J_imgTxt"
-                           accept="image/gif,image/jpeg,image/png,image/jpg,image/bmp"/>
-                </form>
+<!--                <form method="post" id="fileForm" enctype="multipart/form-data" class="addImgH_form" target="up">-->
+<!--                    <input type="file" name="upfile" id="J_imgTxt"-->
+<!--                           accept="image/gif,image/jpeg,image/png,image/jpg,image/bmp"/>-->
+<!--                </form>-->
                 <iframe name="up" style="display: none"></iframe>
             </div>
         </div>