From ce934e032b73d01469cbba8bfff37625c1ffbcf3 Mon Sep 17 00:00:00 2001
From: rahmatalmubarak <rahmatalmubarak35@gmail.com>
Date: Tue, 1 Aug 2023 17:44:45 +0700
Subject: [PATCH] bugfix [v3] add satinize for xss

---
 src/Commands/BadasoSetup.php                             | 1 +
 src/resources/badaso/components/BadasoSelect.vue         | 8 ++++++--
 src/resources/badaso/components/BadasoSelectMultiple.vue | 8 ++++++--
 3 files changed, 13 insertions(+), 4 deletions(-)

diff --git a/src/Commands/BadasoSetup.php b/src/Commands/BadasoSetup.php
index 4cfecd9c9..38f0da045 100644
--- a/src/Commands/BadasoSetup.php
+++ b/src/Commands/BadasoSetup.php
@@ -99,6 +99,7 @@ protected function updatePackageJson()
         $decoded_json['dependencies']['sass'] = '^1.32.11';
         $decoded_json['dependencies']['sass-loader'] = '^11.0.1';
         $decoded_json['dependencies']['resolve-url-loader'] = '^4.0.0';
+        $decoded_json['dependencies']['dompurify'] = '^3.0.5';
 
         $decoded_json['dependencies']['@johmun/vue-tags-input'] = '^2.1.0';
         $decoded_json['dependencies']['@tinymce/tinymce-vue'] = '^3';
diff --git a/src/resources/badaso/components/BadasoSelect.vue b/src/resources/badaso/components/BadasoSelect.vue
index d2f3d44f4..c08c3d386 100644
--- a/src/resources/badaso/components/BadasoSelect.vue
+++ b/src/resources/badaso/components/BadasoSelect.vue
@@ -10,8 +10,8 @@
     >
       <vs-select-item
         :key="index"
-        :value="item.value ? item.value : item"
-        :text="item.label ? item.label : item"
+        :value="satinize(item.value) ? satinize(item.value) : satinize(item)"
+        :text="satinize(item.label) ? satinize(item.label) : satinize(item)"
         v-for="(item, index) in items"
       />
     </vs-select>
@@ -34,6 +34,7 @@
 </template>
 
 <script>
+import * as DOMPurify from 'dompurify';
 export default {
   name: "BadasoSelect",
   components: {},
@@ -70,6 +71,9 @@ export default {
     },
   },
   methods: {
+    satinize(item) {
+      return DOMPurify.sanitize(item)
+    },
     handleInput(val) {
       this.$emit("input", val);
     },
diff --git a/src/resources/badaso/components/BadasoSelectMultiple.vue b/src/resources/badaso/components/BadasoSelectMultiple.vue
index b0f930e89..80c173a75 100644
--- a/src/resources/badaso/components/BadasoSelectMultiple.vue
+++ b/src/resources/badaso/components/BadasoSelectMultiple.vue
@@ -11,8 +11,8 @@
     >
       <vs-select-item
         :key="index"
-        :value="item.value"
-        :text="item.label"
+        :value="satinize(item.value)"
+        :text="satinize(item.label)"
         v-for="(item, index) in items"
       />
     </vs-select>
@@ -38,6 +38,7 @@
 </template>
 
 <script>
+import * as DOMPurify from 'dompurify';
 export default {
   name: "BadasoSelectMultiple",
   components: {},
@@ -75,6 +76,9 @@ export default {
     },
   },
   methods: {
+    satinize(item) {
+      return DOMPurify.sanitize(item)
+    },
     handleInput(val) {
       this.$emit("input", val);
     },