Skip to content

Commit 33774c1

Browse files
committed
Update from to-markdown to turndown
We got a security alert for a regular expression DoS attack on our used library `to-markdown`. After checking `to-markdown` to be maintained or not, it turned out they renamed the library to `turndown`. So upgrading to `turndown` should fix this vulnerbility. References: https://www.npmjs.com/package/to-markdown https://github.com/domchristie/turndown/wiki/Migrating-from-to-markdown-to-Turndown Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
1 parent 2323d20 commit 33774c1

File tree

2 files changed

+8
-3
lines changed

2 files changed

+8
-3
lines changed

package.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -123,8 +123,8 @@
123123
"store": "^2.0.12",
124124
"string": "^3.3.3",
125125
"tedious": "^1.14.0",
126-
"to-markdown": "^3.0.3",
127126
"toobusy-js": "^0.5.1",
127+
"turndown": "^5.0.1",
128128
"uuid": "^3.1.0",
129129
"validator": "^10.4.0",
130130
"velocity-animate": "^1.4.0",

public/js/index.js

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ require('../css/site.css')
1212

1313
require('highlight.js/styles/github-gist.css')
1414

15-
import toMarkdown from 'to-markdown'
15+
import TurndownService from 'turndown'
1616

1717
import { saveAs } from 'file-saver'
1818
import randomColor from 'randomcolor'
@@ -1498,7 +1498,12 @@ $('#snippetExportModalConfirm').click(function () {
14981498
})
14991499

15001500
function parseToEditor (data) {
1501-
var parsed = toMarkdown(data)
1501+
var turndownService = new TurndownService({
1502+
defaultReplacement: function (innerHTML, node) {
1503+
return node.isBlock ? '\n\n' + node.outerHTML + '\n\n' : node.outerHTML
1504+
}
1505+
})
1506+
var parsed = turndownService.turndown(data)
15021507
if (parsed) { replaceAll(parsed) }
15031508
}
15041509

0 commit comments

Comments
 (0)