Fix bugs detected from sonarcloud.

main/package.json

@@ -38,6 +38,7 @@
     "composerize": "^1.2.0",
     "dateformat": "^5.0.3",
     "dayjs": "^1.11.9",
+    "dompurify": "^3.0.6",
     "file-saver": "^2.0.5",
     "gsap": "^3.12.2",
     "hitbox-js": "^1.0.2",
@@ -86,7 +87,6 @@
     "vue2-touch-events": "^3.2.2",
     "vuedraggable": "^2.24.3",
     "vuex": "^3.6.2",
-    "xss": "^1.0.14",
     "xterm": "^4.19.0",
     "xterm-addon-attach": "^0.6.0",
     "xterm-addon-fit": "^0.5.0",

main/src/components/BrandBar.vue

@@ -1,14 +1,15 @@
 <template>
 	<div class="brand-bar is-flex is-align-items-flex-end has-text-white">
 		<figure class="image _is-136x26 mb-3">
-			<!--			<img alt="logo" :srcset="`${require('@/assets/img/logo/logo.svg')} 2x, ${require('@/assets/img/logo/logo.png')} 1x`">-->
 			<img alt="logo" srcset="../assets/img/logo/logo.svg 2x, ../assets/img/logo/logo.png 1x">
 		</figure>
 		<span v-if="!rssShow || rss.length === 0" class="intro-text ml-4">Made with ❤️ by IceWhale and YOU!</span>
 		<span v-else class="window ml-4">
 			<ul :style="{ '--time': 5 * line + 's', '--perc': perc, '--line': line }" class="scroll">
 				<li v-for="(item, key) in rss" :key="key" class="has-text-left" @click="$messageBus('connect_news')">
-					<a :href="xss(item.link)" class="intro-text" target="_blank">{{ item.title }}</a>
+					<a :href="item.link" class="intro-text" target="_blank" rel="noopener noreferrer">
+						{{ item.title }}
+					</a>
 				</li>
 			</ul>
 		</span>
@@ -18,7 +19,7 @@
 
 <script>
 import Parser from "rss-parser";
-import xss from 'xss'
+import DOMPurify from 'dompurify';
 export default {
 	name: "brand-bar",
 	components: {},
@@ -60,7 +61,13 @@ export default {
 			params.l = localStorage.getItem('lang') ? localStorage.getItem('lang') : navigator.language.toLowerCase().replace("-", "_");
 			let stringify = btoa(encodeURIComponent(JSON.stringify(params)))
 			let feed = await parser.parseURL('https://blog.casaos.io/feed/tag/dashboard/?key=' + stringify);
-			this.rss = feed.items
+			const newFeed = feed.items.map(item => {
+				return {
+					title: item.title,
+					link: DOMPurify.sanitize(item.link, {ALLOWED_URI_REGEXP: /^(?:(?:(?:f|ht)tps?|mailto|tel|callto|cid|xmpp):|[^a-z]|[a-z+.1-9]+(?:[^a-z+.1-9]|$))/i})
+				}
+			})
+			this.rss = newFeed
 		}
 	}
 }
@@ -124,7 +131,6 @@ export default {
 	}
 
 	100% {
-		//transform: translate(0, var(--perc)); // slide
 		transform: translate(0, -100%); // Jump upwards
 	}
 }

main/src/components/syncthing/SyncBlock.vue

@@ -17,7 +17,7 @@
 			<div class="buttons is-flex is-flex-shrink-0 is-flex-direction-row-reverse">
 				<b-button class="mb-0" rounded size="is-small" type="is-primary" @click="openSyncPanel">{{
 					$t(actionText)
-					}}
+				}}
 				</b-button>
 			</div>
 			<!-- Init State End -->
@@ -103,8 +103,7 @@ export default {
 				this.$EventBus.$emit(events.OPEN_APP_STORE_AND_GOTO_SYNCTHING);
 			} else {
 				if (this.isSyncRunning) {
-					const arg = `\u003cscript\u003elocation.replace("${this.syncBaseURL}")\u003c/script\u003e`;
-					window.open('javascript:window.name;', arg);
+					window.open(this.syncBaseURL, '_blank');
 				} else {
 					this.$buefy.dialog.confirm({
 						title: ' ',
@@ -113,7 +112,7 @@ export default {
 						closeOnConfirm: false,
 						confirmText: this.$t('Start'),
 						cancelText: this.$t('Cancel'),
-						onConfirm: (value, {close}) => {
+						onConfirm: (value, { close }) => {
 							this.$buefy.toast.open({
 								message: this.$t(`Starting Syncthing...`),
 								type: 'is-white'
@@ -122,10 +121,9 @@ export default {
 								this.isStarting = false
 								if (res.data.success == 200) {
 									this.$EventBus.$emit(events.RELOAD_APP_LIST);
-									const arg = `\u003cscript\u003elocation.replace("${this.syncBaseURL}")\u003c/script\u003e`;
 									setTimeout(() => {
 										close()
-										window.open('javascript:window.name;', arg);
+										window.open(this.syncBaseURL, '_blank');
 
 									}, 2000)
 								} else {
@@ -165,7 +163,8 @@ export default {
 		margin-left: 2rem;
 	}
 }
-.des{
+
+.des {
 	line-height: 1.5em;
 }
 </style>

main/src/mixins/app/Business_OpenThirdApp.js

@@ -21,8 +21,7 @@ export default {
 				const url = `${scheme}://${hostIp}${port}${appInfo.index}`
 
 				if (isNewWindows) {
-					var arg = '\u003cscript\u003elocation.replace("' + url + '")\u003c/script\u003e';
-					window.open('javascript:window.name;', arg);
+					window.open(url);
 				} else {
 					let html = document.createElement('a');
 					html.href = url;

main/src/mixins/mixin.js

@@ -362,7 +362,7 @@ export const mixin = {
 						this.$emit("reload")
 					}
 					try {
-						if (typeof eval(this.reload) === "function") {
+						if (typeof this.reload === "function") {
 							this.reload()
 						}
 					} catch (e) {

yarn.lock

@@ -4826,6 +4826,7 @@ __metadata:
     compression-webpack-plugin: 5.0.2
     dateformat: ^5.0.3
     dayjs: ^1.11.9
+    dompurify: ^3.0.6
     eslint: 6.8.0
     eslint-plugin-vue: ^8.7.1
     file-saver: ^2.0.5
@@ -4893,7 +4894,6 @@ __metadata:
     webpack: 4.46.0
     webpack-bundle-analyzer: ^4.9.0
     webpack-cli: ^4.10.0
-    xss: ^1.0.14
     xterm: ^4.19.0
     xterm-addon-attach: ^0.6.0
     xterm-addon-fit: ^0.5.0
@@ -7256,6 +7256,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"dompurify@npm:^3.0.6":
+  version: 3.0.6
+  resolution: "dompurify@npm:3.0.6"
+  checksum: e5c6cdc5fe972a9d0859d939f1d86320de275be00bbef7bd5591c80b1e538935f6ce236624459a1b0c84ecd7c6a1e248684aa4637512659fccc0ce7c353828a6
+  languageName: node
+  linkType: hard
+
 "domutils@npm:1.5":
   version: 1.5.1
   resolution: "domutils@npm:1.5.1"
@@ -18034,7 +18041,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"xss@npm:^1.0.14, xss@npm:^1.0.9":
+"xss@npm:^1.0.9":
   version: 1.0.14
   resolution: "xss@npm:1.0.14"
   dependencies: