From bf38ae98f1ac3bae2c6006888a8705e42fbb804f Mon Sep 17 00:00:00 2001 From: shamoon <4887959+shamoon@users.noreply.github.com> Date: Thu, 18 Dec 2025 06:31:25 -0800 Subject: [PATCH] Security: remove safe html pipe --- .../admin/settings/settings.component.spec.ts | 2 -- .../admin/trash/trash.component.spec.ts | 2 -- .../confirm-dialog.component.html | 2 +- .../confirm-dialog.component.spec.ts | 5 ++-- .../confirm-dialog.component.ts | 3 +-- .../rotate-confirm-dialog.component.html | 4 ++-- .../rotate-confirm-dialog.component.spec.ts | 3 --- .../rotate-confirm-dialog.component.ts | 3 +-- ...custom-field-edit-dialog.component.spec.ts | 2 -- .../mail-rule-edit-dialog.component.spec.ts | 2 -- .../workflow-edit-dialog.component.spec.ts | 2 -- .../input/entries/entries.component.html | 2 +- .../common/input/file/file.component.html | 2 +- .../input/password/password.component.html | 2 +- .../common/input/text/text.component.html | 2 +- .../common/input/text/text.component.ts | 8 +------ .../input/textarea/textarea.component.html | 2 +- .../input/textarea/textarea.component.ts | 8 +------ .../common/input/url/url.component.html | 2 +- .../permissions-dialog.component.spec.ts | 2 -- .../profile-edit-dialog.component.html | 4 +++- .../profile-edit-dialog.component.ts | 9 +++++-- .../document-list.component.spec.ts | 2 -- .../manage/mail/mail.component.spec.ts | 2 -- .../management-list.component.html | 10 ++++++-- .../management-list.component.spec.ts | 2 -- .../management-list.component.ts | 8 +++++-- .../storage-path-list.component.spec.ts | 2 -- .../storage-path-list.component.ts | 2 -- .../tag-list/tag-list.component.spec.ts | 2 -- .../manage/tag-list/tag-list.component.ts | 11 ++++----- src-ui/src/app/pipes/safehtml.pipe.spec.ts | 24 ------------------- src-ui/src/app/pipes/safehtml.pipe.ts | 13 ---------- 33 files changed, 44 insertions(+), 107 deletions(-) delete mode 100644 src-ui/src/app/pipes/safehtml.pipe.spec.ts delete mode 100644 src-ui/src/app/pipes/safehtml.pipe.ts diff --git a/src-ui/src/app/components/admin/settings/settings.component.spec.ts b/src-ui/src/app/components/admin/settings/settings.component.spec.ts index 300067d1b..cc5c96640 100644 --- a/src-ui/src/app/components/admin/settings/settings.component.spec.ts +++ b/src-ui/src/app/components/admin/settings/settings.component.spec.ts @@ -28,7 +28,6 @@ import { IfOwnerDirective } from 'src/app/directives/if-owner.directive' import { IfPermissionsDirective } from 'src/app/directives/if-permissions.directive' import { PermissionsGuard } from 'src/app/guards/permissions.guard' import { CustomDatePipe } from 'src/app/pipes/custom-date.pipe' -import { SafeHtmlPipe } from 'src/app/pipes/safehtml.pipe' import { PermissionsService } from 'src/app/services/permissions.service' import { GroupService } from 'src/app/services/rest/group.service' import { SavedViewService } from 'src/app/services/rest/saved-view.service' @@ -129,7 +128,6 @@ describe('SettingsComponent', () => { ConfirmDialogComponent, CheckComponent, ColorComponent, - SafeHtmlPipe, SelectComponent, TextComponent, NumberComponent, diff --git a/src-ui/src/app/components/admin/trash/trash.component.spec.ts b/src-ui/src/app/components/admin/trash/trash.component.spec.ts index aa5a8af0f..215b0b253 100644 --- a/src-ui/src/app/components/admin/trash/trash.component.spec.ts +++ b/src-ui/src/app/components/admin/trash/trash.component.spec.ts @@ -11,7 +11,6 @@ import { } from '@ng-bootstrap/ng-bootstrap' import { NgxBootstrapIconsModule, allIcons } from 'ngx-bootstrap-icons' import { of, throwError } from 'rxjs' -import { SafeHtmlPipe } from 'src/app/pipes/safehtml.pipe' import { ToastService } from 'src/app/services/toast.service' import { TrashService } from 'src/app/services/trash.service' import { ConfirmDialogComponent } from '../../common/confirm-dialog/confirm-dialog.component' @@ -53,7 +52,6 @@ describe('TrashComponent', () => { TrashComponent, PageHeaderComponent, ConfirmDialogComponent, - SafeHtmlPipe, ], }).compileComponents() diff --git a/src-ui/src/app/components/common/confirm-dialog/confirm-dialog.component.html b/src-ui/src/app/components/common/confirm-dialog/confirm-dialog.component.html index e25ace612..deee54402 100644 --- a/src-ui/src/app/components/common/confirm-dialog/confirm-dialog.component.html +++ b/src-ui/src/app/components/common/confirm-dialog/confirm-dialog.component.html @@ -8,7 +8,7 @@
{{messageBold}}
} @if (message) { - + } diff --git a/src-ui/src/app/components/common/permissions-dialog/permissions-dialog.component.spec.ts b/src-ui/src/app/components/common/permissions-dialog/permissions-dialog.component.spec.ts index 55cbf152a..e59671921 100644 --- a/src-ui/src/app/components/common/permissions-dialog/permissions-dialog.component.spec.ts +++ b/src-ui/src/app/components/common/permissions-dialog/permissions-dialog.component.spec.ts @@ -5,7 +5,6 @@ import { FormsModule, ReactiveFormsModule } from '@angular/forms' import { NgbActiveModal, NgbModule } from '@ng-bootstrap/ng-bootstrap' import { NgSelectModule } from '@ng-select/ng-select' import { of } from 'rxjs' -import { SafeHtmlPipe } from 'src/app/pipes/safehtml.pipe' import { UserService } from 'src/app/services/rest/user.service' import { PermissionsFormComponent } from '../input/permissions/permissions-form/permissions-form.component' import { PermissionsGroupComponent } from '../input/permissions/permissions-group/permissions-group.component' @@ -41,7 +40,6 @@ describe('PermissionsDialogComponent', () => { ReactiveFormsModule, NgbModule, PermissionsDialogComponent, - SafeHtmlPipe, SelectComponent, SwitchComponent, PermissionsFormComponent, diff --git a/src-ui/src/app/components/common/profile-edit-dialog/profile-edit-dialog.component.html b/src-ui/src/app/components/common/profile-edit-dialog/profile-edit-dialog.component.html index a8627f19c..67098b55c 100644 --- a/src-ui/src/app/components/common/profile-edit-dialog/profile-edit-dialog.component.html +++ b/src-ui/src/app/components/common/profile-edit-dialog/profile-edit-dialog.component.html @@ -110,7 +110,9 @@diff --git a/src-ui/src/app/components/common/profile-edit-dialog/profile-edit-dialog.component.ts b/src-ui/src/app/components/common/profile-edit-dialog/profile-edit-dialog.component.ts index c4a103397..d6c839f1e 100644 --- a/src-ui/src/app/components/common/profile-edit-dialog/profile-edit-dialog.component.ts +++ b/src-ui/src/app/components/common/profile-edit-dialog/profile-edit-dialog.component.ts @@ -18,7 +18,6 @@ import { SocialAccountProvider, TotpSettings, } from 'src/app/data/user-profile' -import { SafeHtmlPipe } from 'src/app/pipes/safehtml.pipe' import { ProfileService } from 'src/app/services/profile.service' import { ToastService } from 'src/app/services/toast.service' import { setLocationHref } from 'src/app/utils/navigation' @@ -37,7 +36,6 @@ import { TextComponent } from '../input/text/text.component' PasswordComponent, FormsModule, ReactiveFormsModule, - SafeHtmlPipe, NgbAccordionModule, NgbPopoverModule, NgxBootstrapIconsModule, @@ -89,6 +87,13 @@ export class ProfileEditDialogComponent public socialAccounts: SocialAccount[] = [] public socialAccountProviders: SocialAccountProvider[] = [] + get qrSvgDataUrl(): string | null { + if (!this.totpSettings?.qr_svg) { + return null + } + return `data:image/svg+xml;utf8,${encodeURIComponent(this.totpSettings.qr_svg)}` + } + ngOnInit(): void { this.networkActive = true this.profileService diff --git a/src-ui/src/app/components/document-list/document-list.component.spec.ts b/src-ui/src/app/components/document-list/document-list.component.spec.ts index a64d79e49..f39225f3f 100644 --- a/src-ui/src/app/components/document-list/document-list.component.spec.ts +++ b/src-ui/src/app/components/document-list/document-list.component.spec.ts @@ -36,7 +36,6 @@ import { PermissionsGuard } from 'src/app/guards/permissions.guard' import { CustomDatePipe } from 'src/app/pipes/custom-date.pipe' import { DocumentTitlePipe } from 'src/app/pipes/document-title.pipe' import { FilterPipe } from 'src/app/pipes/filter.pipe' -import { SafeHtmlPipe } from 'src/app/pipes/safehtml.pipe' import { UsernamePipe } from 'src/app/pipes/username.pipe' import { DocumentListViewService } from 'src/app/services/document-list-view.service' import { PermissionsService } from 'src/app/services/permissions.service' @@ -103,7 +102,6 @@ describe('DocumentListComponent', () => { DatePipe, DocumentTitlePipe, UsernamePipe, - SafeHtmlPipe, PermissionsGuard, provideHttpClient(withInterceptorsFromDi()), provideHttpClientTesting(), diff --git a/src-ui/src/app/components/manage/mail/mail.component.spec.ts b/src-ui/src/app/components/manage/mail/mail.component.spec.ts index 38293aca9..c866160d4 100644 --- a/src-ui/src/app/components/manage/mail/mail.component.spec.ts +++ b/src-ui/src/app/components/manage/mail/mail.component.spec.ts @@ -23,7 +23,6 @@ import { IfOwnerDirective } from 'src/app/directives/if-owner.directive' import { IfPermissionsDirective } from 'src/app/directives/if-permissions.directive' import { PermissionsGuard } from 'src/app/guards/permissions.guard' import { CustomDatePipe } from 'src/app/pipes/custom-date.pipe' -import { SafeHtmlPipe } from 'src/app/pipes/safehtml.pipe' import { PermissionsService } from 'src/app/services/permissions.service' import { MailAccountService } from 'src/app/services/rest/mail-account.service' import { MailRuleService } from 'src/app/services/rest/mail-rule.service' @@ -84,7 +83,6 @@ describe('MailComponent', () => { CustomDatePipe, ConfirmDialogComponent, CheckComponent, - SafeHtmlPipe, SelectComponent, TextComponent, PasswordComponent, diff --git a/src-ui/src/app/components/manage/management-list/management-list.component.html b/src-ui/src/app/components/manage/management-list/management-list.component.html index 23e518f31..8fac6f44f 100644 --- a/src-ui/src/app/components/manage/management-list/management-list.component.html +++ b/src-ui/src/app/components/manage/management-list/management-list.component.html @@ -94,8 +94,14 @@