rubygem-yard/CVE-2024-27285.patch

28 lines
1.0 KiB
Diff
Raw Normal View History

2024-02-29 10:37:42 +08:00
From d78fc393d603c4fc35975969296ed381146a29d4 Mon Sep 17 00:00:00 2001
From: Aviv Keller <38299977+RedYetiDev@users.noreply.github.com>
Date: Wed, 28 Feb 2024 12:57:39 -0500
Subject: [PATCH] Update frames.erb
---
templates/default/fulldoc/html/frames.erb | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/templates/default/fulldoc/html/frames.erb b/templates/default/fulldoc/html/frames.erb
index e803bcd6c..994aee97e 100644
--- a/templates/default/fulldoc/html/frames.erb
+++ b/templates/default/fulldoc/html/frames.erb
@@ -5,10 +5,10 @@
<title><%= options.title %></title>
</head>
<script type="text/javascript">
- var match = unescape(window.location.hash).match(/^#!(.+)/);
+ var match = decodeURIComponent(window.location.hash).match(/^#!(.+)/);
var name = match ? match[1] : '<%= url_for_main %>';
- name = name.replace(/^(\w+):\/\//, '').replace(/^\/\//, '');
- window.top.location = name;
+ name = name.replace(/^((\w*):)?[\/\\]*/gm, '').trim();
+ window.top.location.replace(name)
</script>
<noscript>
<h1>Oops!</h1>