From e4c0401dccbf137980a32948cd1c68f31f6e8c76 Mon Sep 17 00:00:00 2001 From: Chad Norvell Date: Wed, 24 Jan 2024 19:33:00 +0000 Subject: [PATCH] rustdoc: Remove regex sanitation --- src/librustdoc/html/static/js/storage.js | 17 +++++------------ 1 file changed, 5 insertions(+), 12 deletions(-) diff --git a/src/librustdoc/html/static/js/storage.js b/src/librustdoc/html/static/js/storage.js index bf9ae1842e18a..bda7b3c647e7e 100644 --- a/src/librustdoc/html/static/js/storage.js +++ b/src/librustdoc/html/static/js/storage.js @@ -24,15 +24,7 @@ function getSettingValue(settingName) { return def; } } - // Strip out characters we don't expect to find in settings values. - // This prevents an injection vulnerability where someone could plant - // JS code into the localStorage value, which could be executed when - // we pull it out. - if (current) { - return current.replace(/[\s()[\]{}*"'`<>.:;=&|]/g,""); - } - - return null; + return current; } const localStoredTheme = getSettingValue("theme"); @@ -109,10 +101,11 @@ const getVar = (function getVar(name) { }); function switchTheme(newThemeName, saveTheme) { - const theme_names = getVar("themes").split(",").filter(t => t); - theme_names.push("light", "dark", "ayu"); + const themeNames = getVar("themes").split(",").filter(t => t); + themeNames.push(...builtinThemes); - if (theme_names.indexOf(newThemeName) == -1) { + // Ensure that the new theme name is among the defined themes + if (themeNames.indexOf(newThemeName) === -1) { return; }