Skip to content

fix: can not select Chinese font family name. #1901

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
Jocs merged 1 commit into from
Feb 11, 2020
Merged

fix: can not select Chinese font family name. #1901

Jocs merged 1 commit into from
Feb 11, 2020

Conversation

@Jocs
Copy link
Member

@Jocs Jocs commented Feb 8, 2020 •
edited
Loading

Q A
Bug fix? yes
New feature? no
Breaking changes? no
Deprecations? no
New tests added? not needed
Fixed tickets #1773
License MIT

Description

[Description of the bug or feature]

This change is Reviewable

@Jocs Jocs merged commit 1c7e852 into develop Feb 11, 2020
@Jocs Jocs deleted the fix-1773 branch February 11, 2020 13:56
fxha
fxha reviewed Feb 21, 2020
View reviewed changes
src/renderer/prefComponents/common/fontTextBox/index.vue
handleSelect (value) {
if (/^[_A-z0-9]+((-|\s)*[_A-z0-9])*$/.test(value)) {
if (/^[^\s]+((-|\s)*[^\s])*$/.test(value)) {
Copy link
Contributor

@fxha fxha Feb 21, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@Jocs I think you forgot to edit the preferences/schema.json file to allow all font families. When doing so, you should remove the regex completely and implement a proper XSS protection on the editor (renderer) to prevent bad font names. The attack vector is no very high but it's still a file-based Cross-Site Scripting when we don't verify the font family.

@LosikiS
Copy link

LosikiS commented Feb 21, 2020 •
edited
Loading

When I try to change font to 微软雅黑 (or other font with Chinese characters)
ERROR

An unexpected error occurred in the main process
Error: Config schema violation: `editorFontFamily` should match pattern "^[_A-z0-9]+((-|\s)[_A-z0-9])$"
at ElectronStore._validate (D:_files\marktext-x64-win-v0.16.0-rc.3\resources\app.asar\node_modules\conf\index.js:154:10)
at ElectronStore.set store [as store] (D:_files\marktext-x64-win-v0.16.0-rc.3\resources\app.asar\node_modules\conf\index.js:448:8)
at ElectronStore.set (D:_files\marktext-x64-win-v0.16.0-rc.3\resources\app.asar\node_modules\conf\index.js:327:14)
at Yt.setItem (D:_files\marktext-x64-win-v0.16.0-rc.3\resources\app.asar\dist\electron\main.js:2:326174)
at D:_files\marktext-x64-win-v0.16.0-rc.3\resources\app.asar\dist\electron\main.js:2:326261
at Array.map ()
at Yt.setItems (D:_files\marktext-x64-win-v0.16.0-rc.3\resources\app.asar\dist\electron\main.js:2:326248)
at IpcMainImpl. (D:_files\marktext-x64-win-v0.16.0-rc.3\resources\app.asar\dist\electron\main.js:2:326703)
at IpcMainImpl.emit (events.js:210:5)
at WebContents. (electron/js2c/browser_init.js:3839:15)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@fxha fxha fxha left review comments

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@Jocs @LosikiS @fxha