{
+ const out = stripScriptTags('beforedone');
+ expect(out.toLowerCase()).not.toContain(' {
+ const html = 'keep me
The word script is fine here
';
+ expect(stripScriptTags(html)).toBe(html);
+ });
+});
diff --git a/public/files/perm/idevices/base/adaptative-quiz/edition/adaptative-quiz.js b/public/files/perm/idevices/base/adaptative-quiz/edition/adaptative-quiz.js
index 90124ad4ae..4855ba86cd 100644
--- a/public/files/perm/idevices/base/adaptative-quiz/edition/adaptative-quiz.js
+++ b/public/files/perm/idevices/base/adaptative-quiz/edition/adaptative-quiz.js
@@ -158,10 +158,15 @@ var $exeDevice = {
normalizeQuestionsPerRound: value => Math.max(parseInt(value, 10) || 1, 1),
- removeTags: str =>
- String(str ?? '')
- .replace(/<[^>]*>/g, '')
- .trim(),
+ removeTags: str => {
+ let result = String(str ?? '');
+ let prev;
+ do {
+ prev = result;
+ result = result.replace(/<[^>]*>/g, '');
+ } while (result !== prev);
+ return result.trim();
+ },
/**
* Reusable audio input with voice recorder, matching quick-questions'
diff --git a/public/files/perm/idevices/base/adaptative-quiz/edition/adaptative-quiz.test.js b/public/files/perm/idevices/base/adaptative-quiz/edition/adaptative-quiz.test.js
index 5ee6a7b9ab..b63341f97d 100644
--- a/public/files/perm/idevices/base/adaptative-quiz/edition/adaptative-quiz.test.js
+++ b/public/files/perm/idevices/base/adaptative-quiz/edition/adaptative-quiz.test.js
@@ -1936,4 +1936,33 @@ describe('adaptative-quiz edition', () => {
expect(validateCalls).toBe(0);
});
});
+
+ describe('removeTags', () => {
+ it('strips a simple tag and trims the remaining text', () => {
+ expect(idevice.removeTags(' Hello
')).toBe('Hello');
+ });
+
+ it('returns an empty string for nullish input', () => {
+ expect(idevice.removeTags(null)).toBe('');
+ expect(idevice.removeTags(undefined)).toBe('');
+ });
+
+ it('leaves no live ',
+ '</script>',
+ 'ipt>alert(1)',
+ ];
+ for (const payload of payloads) {
+ expect(idevice.removeTags(payload).toLowerCase()).not.toContain(' {
+ expect(idevice.removeTags(' Plain question text ')).toBe('Plain question text');
+ expect(idevice.removeTags('2 plus 3 equals 5')).toBe('2 plus 3 equals 5');
+ });
+ });
});
diff --git a/public/files/perm/idevices/base/az-quiz-game/edition/az-quiz-game.js b/public/files/perm/idevices/base/az-quiz-game/edition/az-quiz-game.js
index e926b0e4ed..be5feeaacf 100644
--- a/public/files/perm/idevices/base/az-quiz-game/edition/az-quiz-game.js
+++ b/public/files/perm/idevices/base/az-quiz-game/edition/az-quiz-game.js
@@ -1212,11 +1212,16 @@ var $exeDevice = {
const words = [];
$entries.find('ENTRY').each(function () {
- const concept = $(this).find('CONCEPT').text(),
- definition = $(this)
- .find('DEFINITION')
- .text()
- .replace(/<[^>]*>/g, '');
+ const concept = $(this).find('CONCEPT').text();
+ let definition = $(this).find('DEFINITION').text();
+ // Strip HTML tags repeatedly: removing one tag can splice
+ // surrounding characters into a new tag (e.g. "<script>"),
+ // so loop until the string stops changing.
+ let prevDefinition;
+ do {
+ prevDefinition = definition;
+ definition = definition.replace(/<[^>]*>/g, '');
+ } while (definition !== prevDefinition);
if (concept && definition) {
words.push(`${concept}#${definition}`);
}
diff --git a/public/files/perm/idevices/base/az-quiz-game/edition/az-quiz-game.test.js b/public/files/perm/idevices/base/az-quiz-game/edition/az-quiz-game.test.js
index f0294d99ba..f1549c393e 100644
--- a/public/files/perm/idevices/base/az-quiz-game/edition/az-quiz-game.test.js
+++ b/public/files/perm/idevices/base/az-quiz-game/edition/az-quiz-game.test.js
@@ -32,7 +32,13 @@ function loadIdevice(code) {
// Helper to strip HTML tags
const stripTags = (html) => {
if (!html) return '';
- return String(html).replace(/<[^>]*>/g, '');
+ let result = String(html);
+ let prev;
+ do {
+ prev = result;
+ result = result.replace(/<[^>]*>/g, '');
+ } while (result !== prev);
+ return result;
};
// Mock jQuery with chaining support
@@ -525,4 +531,57 @@ describe('az-quiz-game iDevice', () => {
expect(typeof $exeDevice.validateData).toBe('function');
});
});
+
+ describe('mock $ text() stripTags helper', () => {
+ it('strips a simple HTML tag from selector text', () => {
+ expect(global.$('Hello
').text()).toBe('Hello');
+ });
+
+ it('strips nested/obfuscated tags, leaving no complete tag behind', () => {
+ // The fixed-point loop keeps stripping until the string stops
+ // changing, so a nested/obfuscated payload cannot leave a complete
+ // `<...>` tag (in particular, no `';
+ const result = global.$(payload).text();
+ // No surviving complete HTML tag, and no `');
+ expect(result).not.toMatch(/<[^>]*>/);
+ });
+
+ it('leaves plain text without tags unchanged', () => {
+ expect(global.$('Plain text').text()).toBe('Plain text');
+ });
+ });
+
+ describe('importGlosary definition sanitization', () => {
+ // importGlosary strips HTML tags from each DEFINITION using a
+ // fixed-point loop so that removing one tag cannot splice surrounding
+ // characters into a new tag. This mirrors the source logic and asserts
+ // the security property on an obfuscated payload while preserving
+ // legitimate text.
+ const stripDefinition = (text) => {
+ let definition = text;
+ let prevDefinition;
+ do {
+ prevDefinition = definition;
+ definition = definition.replace(/<[^>]*>/g, '');
+ } while (definition !== prevDefinition);
+ return definition;
+ };
+
+ it('leaves no complete tag behind for an obfuscated payload', () => {
+ const payload = 'ipt>The Sun';
+ const result = stripDefinition(payload);
+ expect(result.toLowerCase()).not.toContain('';
+ const cleaned = $exeDevice.stripTags(payload);
+ // The dangerous ") is left behind.
+ expect(cleaned).not.toMatch(/<[^>]*>/);
+ });
+
+ it('reaches a fixed point: re-stripping the output is a no-op', () => {
+ const payload = '<