rustdoc: Prevent JS injection from localStorage

Chad Norvell · Chad Norvell · commit 2af09b662fb3 · 2024-01-22T21:06:55.000Z
diff --git a/src/librustdoc/html/static/js/storage.js b/src/librustdoc/html/static/js/storage.js
@@ -24,7 +24,7 @@ function getSettingValue(settingName) {
             return def;
         }
     }
-    return current;
+    return current.replace(/[^A-Za-z0-9_-]/g,"");
 }
 
 const localStoredTheme = getSettingValue("theme");

Original file line number	Diff line number	Diff line change
`@@ -24,7 +24,7 @@ function getSettingValue(settingName) {`
`24`	`24`	`return def;`
`25`	`25`	`}`
`26`	`26`	`}`
`27`		`- return current;`
	`27`	`+ return current.replace(/[^A-Za-z0-9_-]/g,"");`
`28`	`28`	`}`
`29`	`29`
`30`	`30`	`const localStoredTheme = getSettingValue("theme");`