From 09bfd810abd601d0a58f1e968fe4619d2ad1360e Mon Sep 17 00:00:00 2001
From: lwch <lwch748@gmail.com>
Date: Fri, 29 Jul 2022 15:37:56 +0800
Subject: [PATCH] =?UTF-8?q?=E4=BF=AE=E6=AD=A3CodeQL=E9=97=AE=E9=A2=98?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 html/dashboard/js/terminal.js | 2 +-
 html/js/common.js             | 7 +++++++
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/html/dashboard/js/terminal.js b/html/dashboard/js/terminal.js
index ad48116..199bb74 100644
--- a/html/dashboard/js/terminal.js
+++ b/html/dashboard/js/terminal.js
@@ -48,7 +48,7 @@ var page = {
         </div>`;
         var obj = $(str);
         obj.attr('id', 'tab-'+idx);
-        obj.find('iframe').attr('src', 'http://'+location.hostname+':'+$('#terms').val());
+        obj.find('iframe').attr('src', 'http://'+location.hostname+':'+escape($('#terms').val()));
         $('#tab-content').append(obj);
         page.idx++;
     },
diff --git a/html/js/common.js b/html/js/common.js
index 54feee1..d575533 100644
--- a/html/js/common.js
+++ b/html/js/common.js
@@ -2,6 +2,13 @@ function arg(key) {
     var url = new URL(location.href);
     return decodeURIComponent(url.searchParams.get(key));
 }
+function escape(htmlStr) {
+    return htmlStr.replace(/&/g, "&amp;")
+          .replace(/</g, "&lt;")
+          .replace(/>/g, "&gt;")
+          .replace(/"/g, "&quot;")
+          .replace(/'/g, "&#39;");
+}
 var humanize = {
     bytes: function(n) {
         return humanize.humanate_bytes(n, 1024, ['B', 'KB', 'MB', 'GB', 'TB', 'PB', 'EB'])