Merge pull request #1218 from basecamp/refactor-xss-fix

intrip · web-flow · commit c4f0d6f80654 · 2024-12-20T10:43:21.000-05:00
Refactor link XSS patch
diff --git a/src/trix/controllers/toolbar_controller.js b/src/trix/controllers/toolbar_controller.js
@@ -208,19 +208,20 @@ export default class ToolbarController extends BasicObject {
     const attributeName = getAttributeName(dialogElement)
     const input = getInputForDialog(dialogElement, attributeName)
 
-    input.willValidate && input.setCustomValidity("")
-    if (input.willValidate && !input.checkValidity() || !this.safeAttribute(input)) {
-      input.setCustomValidity("Invalid value")
-      input.setAttribute("data-trix-validate", "")
-      input.classList.add("trix-validate")
-      return input.focus()
-    } else {
-      this.delegate?.toolbarDidUpdateAttribute(attributeName, input.value)
-      return this.hideDialog()
+    if (input.willValidate) {
+      input.setCustomValidity("")
+      if (!input.checkValidity() || !this.isSafeAttribute(input)) {
+        input.setCustomValidity("Invalid value")
+        input.setAttribute("data-trix-validate", "")
+        input.classList.add("trix-validate")
+        return input.focus()
+      }
     }
+    this.delegate?.toolbarDidUpdateAttribute(attributeName, input.value)
+    return this.hideDialog()
   }
 
-  safeAttribute(input) {
+  isSafeAttribute(input) {
     if (input.hasAttribute("data-trix-validate-href")) {
       return DOMPurify.isValidAttribute("a", "href", input.value)
     } else {
