-
-
Notifications
You must be signed in to change notification settings - Fork 337
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
9 changed files
with
212 additions
and
7 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,20 @@ | ||
| # Security Policy | ||
|
|
||
| ## Supported Versions | ||
|
|
||
| | Version | Supported | | ||
| | ------- | ------------------ | | ||
| | >= 1.3.2 | :white_check_mark: | | ||
| | < 1.3.2 | upgrade required | | ||
|
|
||
| ## Reporting a Vulnerability | ||
|
|
||
| 1. **Contact us** by sending an email to **[security@getgrist.com](mailto:security@getgrist.com)** with the following information: | ||
| - A description of the vulnerability. | ||
| - Steps to reproduce the issue. | ||
| - Any known impacts or suggested fixes. | ||
|
|
||
| 2. **Our response:** | ||
| - We will acknowledge your report within **three working days**. | ||
| - We will collaborate with you to verify and address the issue. | ||
| - Once resolved, we’ll release a patch and notify users. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,76 @@ | ||
| // This file should be run during build. It will go through all the translations in the static/locales | ||
| // directory, and pass every key and value through the sanitizer. | ||
|
|
||
| const fs = require('fs'); | ||
| const path = require('path'); | ||
| // Initialize purifier. | ||
| const createDOMPurify = require('dompurify'); | ||
| const { JSDOM } = require('jsdom'); | ||
| const window = new JSDOM('').window; | ||
| const DOMPurify = createDOMPurify(window); | ||
| DOMPurify.addHook('uponSanitizeAttribute', handleSanitizeAttribute); | ||
| function handleSanitizeAttribute(node) { | ||
| if (!('target' in node)) { return; } | ||
| node.setAttribute('target', '_blank'); | ||
| } | ||
|
|
||
| const directoryPath = readDirectoryPath(); | ||
|
|
||
| const fileStream = fs.readdirSync(directoryPath) | ||
| .map((file) => path.join(directoryPath, file)) | ||
| // Make sure it's a file | ||
| .filter((file) => fs.lstatSync(file).isFile()) | ||
| // Make sure it is json file | ||
| .filter((file) => file.endsWith(".json")) | ||
| // Read the contents and put it into an array [path, json] | ||
| .map((file) => [file, JSON.parse(fs.readFileSync(file, "utf8"))]); | ||
|
|
||
| console.debug(`Found ${fileStream.length} files to sanitize`); | ||
|
|
||
| const sanitized = fileStream.map(([file, json]) => { | ||
| return [file, json, sanitizedJson(json)]; | ||
| }); | ||
|
|
||
| const onlyDifferent = sanitized.filter(([file, json, sanitizedJson]) => { | ||
| return JSON.stringify(json) !== JSON.stringify(sanitizedJson); | ||
| }); | ||
|
|
||
| console.debug(`Found ${onlyDifferent.length} files that need sanitizing`); | ||
|
|
||
| // Write the sanitized json back to the files | ||
| onlyDifferent.forEach(([file, json, sanitizedJson]) => { | ||
| console.info(`Sanitizing ${file}`); | ||
| fs.writeFileSync(file, JSON.stringify(sanitizedJson, null, 4) + "\n"); | ||
| }); | ||
|
|
||
| console.info("Sanitization complete"); | ||
|
|
||
| function sanitizedJson(json) { | ||
| // This is recursive function as some keys can be objects themselves, but all values are either | ||
| // strings or objects. | ||
| return Object.keys(json).reduce((acc, key) => { | ||
| const value = json[key]; | ||
| if (typeof value === "string") { | ||
| acc[key] = purify(value); | ||
| } else if (typeof value === "object") { | ||
| acc[key] = sanitizedJson(value); | ||
| } | ||
| return acc; | ||
| }, {}); | ||
| } | ||
|
|
||
|
|
||
| function readDirectoryPath() { | ||
| // Directory path is optional, it defaults to static/locales, but can be passed as an argument. | ||
| const args = process.argv.slice(2); | ||
| if (args.length > 1) { | ||
| console.error("Too many arguments, expected at most 1 argument."); | ||
| process.exit(1); | ||
| } | ||
| return args[0] || path.join(__dirname, "../static/locales"); | ||
| } | ||
|
|
||
| function purify(inputString) { | ||
| // This removes any html tags from the string | ||
| return DOMPurify.sanitize(inputString); | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,26 @@ | ||
| { | ||
| "ACUserManager": { | ||
| "We'll email an invite to {{email}}": "Küldünk egy meghívó e-mailt ide: {{email}}", | ||
| "Enter email address": "Adja meg az e-mail címet", | ||
| "Invite new member": "Új tag meghívása" | ||
| }, | ||
| "AccessRules": { | ||
| "Add User Attributes": "Új felhasználó attribútum", | ||
| "Everyone": "Mindenki", | ||
| "Default Rules": "Alapértelmezett szabályok", | ||
| "Invalid": "Érvénytelen", | ||
| "Add Table Rules": "Új táblázat szabály", | ||
| "Add Column Rule": "Új oszlop szabály", | ||
| "Add Default Rule": "Új alapértelmezett szabály", | ||
| "Attribute name": "Attribútum neve", | ||
| "Allow everyone to view Access Rules.": "Mindeki láthassa a hozzáférési szabályokat.", | ||
| "Attribute to Look Up": "Keresendő attribútum", | ||
| "Checking...": "Ellenőrzés…", | ||
| "Condition": "Feltétel", | ||
| "Delete Table Rules": "Táblázat szabályok törlése", | ||
| "Enter Condition": "Írja be a feltételt", | ||
| "Everyone Else": "Mindenki más", | ||
| "Lookup Column": "Keresési oszlop", | ||
| "Lookup Table": "Keresési táblázat" | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,8 @@ | ||
| { | ||
| "sendAppPage": { | ||
| "Loading": "Töltés" | ||
| }, | ||
| "oidc": { | ||
| "emailNotVerifiedError": "Kérem ellenőrizze az e-mail címet az azonosítási szolgáltatónál, és jelentkezzen be újra." | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters