mealie/frontend/components/global/MarkdownEditor.vue
Hayden 13850cda1f
security: multiple reported CVE fixes (#1515)
* update out of date license

* update typing / refactor

* fix arbitrarty path injection

* use markdown sanatizer to prevent XSS CWE-79

* fix CWE-918 SSRF by validating url and mime type

* add security docs

* update recipe-scrapers

* resolve DOS from arbitrary url

* update changelog

* bump version

* add ref to #1506

* add #1511 to changelog

* use requests decoder

* actually fix encoding issue
2022-07-31 13:10:20 -08:00

86 lines
1.7 KiB
Vue

<template>
<div>
<div v-if="displayPreview" class="d-flex justify-end">
<BaseButtonGroup
:buttons="[
{
icon: previewState ? $globals.icons.edit : $globals.icons.eye,
text: previewState ? $tc('general.edit') : 'Preview Markdown',
event: 'toggle',
},
]"
@toggle="previewState = !previewState"
/>
</div>
<v-textarea
v-if="!previewState"
v-bind="textarea"
v-model="inputVal"
:class="label == '' ? '' : 'mt-5'"
:label="label"
auto-grow
dense
rows="4"
/>
<SafeMarkdown v-else :source="value" />
</div>
</template>
<script lang="ts">
import { defineComponent, computed, ref } from "@nuxtjs/composition-api";
export default defineComponent({
name: "MarkdownEditor",
props: {
value: {
type: String,
required: true,
},
label: {
type: String,
default: "",
},
preview: {
type: Boolean,
default: undefined,
},
displayPreview: {
type: Boolean,
default: true,
},
textarea: {
type: Object,
default: () => ({}),
},
},
setup(props, context) {
const fallbackPreview = ref(false);
const previewState = computed({
get: () => {
return props.preview ?? fallbackPreview.value;
},
set: (val) => {
if (props.preview) {
context.emit("input:preview", val);
} else {
fallbackPreview.value = val;
}
},
});
const inputVal = computed({
get: () => {
return props.value;
},
set: (val) => {
context.emit("input", val);
},
});
return {
previewState,
inputVal,
};
},
});
</script>