feat: only allow checkbox

taigaio · Apr 25, 2024 · b95adc9 · b95adc9
1 parent 29e29a1
commit b95adc9
Showing 1 changed file with 8 additions and 0 deletions.
diff --git a/app/js/angular-sanitize.js b/app/js/angular-sanitize.js
@@ -485,6 +485,14 @@ function $SanitizeProvider() {
         if (!ignoreCurrentElement && blockedElements[tag]) {
           ignoreCurrentElement = tag;
         }
+        const validCheckbox = validElements['input'] && validAttrs['checked'];
+
+        if (validCheckbox) {
+          if (tag === 'input' && attrs.type !== 'checkbox') {
+            return;
+          }
+        }
+
         if (!ignoreCurrentElement && validElements[tag] === true) {
           out('<');
           out(tag);