kim/homeclaw
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: 투자앱 차트 링크 onclick/텍스트 이스케이프 처리 (XSS 방지)

Browse Source
This commit is contained in:
kim
2026-07-05 13:11:08 +09:00
parent 2f965f7493
commit ce1a99b723
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
web-ui/investor-app.html
+2 -2
View File
@@ -732,14 +732,14 @@ function renderMdSafe(text){
const parts=body.trim().split('|');const code=parts[0].trim().replace(/\D/g,'');const period=(parts[1]||'day').trim().toLowerCase();
if(!code)return m;
const ph=`\x00CHART${charts.length}\x00`;
charts.push(`<span class="iv-chart-link" onclick="loadKStock('${code}','${code}','${period}')">📈 ${code} · ${period} 차트 보기</span>`);
charts.push(`<span class="iv-chart-link" onclick="loadKStock('${escAttr(code)}','${escAttr(code)}','${escAttr(period)}')">📈 ${escHtml(code)} · ${escHtml(period)} 차트 보기</span>`);
return ph;
})
.replace(/```tradingview\s*\n([^`]+?)\n```/g,(m,body)=>{
const parts=body.trim().split('|');const sym=parts[0].trim().toUpperCase();const iv=(parts[1]||'D').trim().toUpperCase();
if(!sym)return m;
const ph=`\x00CHART${charts.length}\x00`;
charts.push(`<span class="iv-chart-link" onclick="loadTV('${sym}','${iv}','${sym}')">📈 ${sym} · ${iv} 차트 보기</span>`);
charts.push(`<span class="iv-chart-link" onclick="loadTV('${escAttr(sym)}','${escAttr(iv)}','${escAttr(sym)}')">📈 ${escHtml(sym)} · ${escHtml(iv)} 차트 보기</span>`);
return ph;
});
// HTML escape