Fix for unsafe constructs (!806) · Merge requests · Vinay Rosenberg / dash-js · GitLab

GitLab now enforces expiry dates on tokens that originally had no set expiration date. Those tokens were given an expiration date of one year later. Please review your personal access tokens, project access tokens, and group access tokens to ensure you are aware of upcoming expirations. Administrators of GitLab can find more information on how to identify and mitigate interruption in our documentation.

Vinay Rosenberg requested to merge github/fork/MobiTV-AB/fix-innerHTML-vulnerability into development Sep 23, 2015

Created by: TobbeMobiTV

Replacement of unsafe constructs (innerHTML) with textContent, and filtering of characters in lang attribute in manifest to allowed ones.

Fixes #787 (closed).

Test content: http://async5.org/dash/ED_OnDemand_5SecSeg_Subtitles.mpd http://streamtest.eu/dash/vod/testpic_2s/bug_subs.mpd

The first one is from #787 (closed) for the "lang" attribute. The second is for TTML subtitle text.