lsm/layui
1
0
Fork 0
mirror of https://gitee.com/layui/layui.git synced 2025-04-05 17:38:02 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

fix(form-select): 修复 XSS 漏洞 (#1813)

Browse Source
This commit is contained in:
morning-star 2024-04-22 17:21:45 +08:00 committed by GitHub
parent 747c786040
commit b94811ec09
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 7 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
src/modules/form.js
View File

@ -654,14 +654,13 @@ layui.define(['lay', 'layer', 'util'], function(exports){
if(hasEquals){
dl.children('.' + CREATE_OPTION).remove();
}else{
// 和初始渲染保持行为一致
var textVal = $('<div>' + value +'</div>').text();
var createOptionElem = dl.children('.' + CREATE_OPTION);
if(createOptionElem[0]){
createOptionElem.attr('lay-value', value);
createOptionElem.text(textVal);
createOptionElem.attr('lay-value', value).html(util.escape(value));
}else{
dl.append('<dd class="' + CREATE_OPTION + '" lay-value="'+ value +'">' + textVal + '</dd>');
var ddElem = $('<dd>');
ddElem.addClass(CREATE_OPTION).attr('lay-value', value).html(util.escape(value));
dl.append(ddElem);
}
}
}else{
@ -722,7 +721,9 @@ layui.define(['lay', 'layer', 'util'], function(exports){
if(isCreatable && othis.hasClass(CREATE_OPTION)){
othis.removeClass(CREATE_OPTION);
select.append('<option value="' + value + '">' + value + '</option>');
var optionElem = $('<option>');
optionElem.attr('value', value).text(othis.text());
select.append(optionElem);
}
othis.siblings().removeClass(THIS);