diff --git a/app/src/Server.js b/app/src/Server.js index 72dee596..fa6a121e 100644 --- a/app/src/Server.js +++ b/app/src/Server.js @@ -58,7 +58,7 @@ dev dependencies: { * @license For commercial or closed source, contact us at license.mirotalk@gmail.com or purchase directly via CodeCanyon * @license CodeCanyon: https://codecanyon.net/item/mirotalk-sfu-webrtc-realtime-video-conferences/40769970 * @author Miroslav Pejic - miroslav.pejic.85@gmail.com - * @version 1.7.73 + * @version 1.7.74 * */ diff --git a/app/src/XSS.js b/app/src/XSS.js index d2001042..db69e7ab 100644 --- a/app/src/XSS.js +++ b/app/src/XSS.js @@ -71,11 +71,19 @@ function needsDecoding(str) { return urlEncodedPattern.test(str); } -// Recursively sanitize data based on its type +function safeDecodeURIComponent(str) { + try { + return decodeURIComponent(str); + } catch (e) { + log.error('Malformed URI component detected:', str); + return str; // Return original string if decoding fails + } +} + function sanitizeData(data) { if (typeof data === 'string') { // Decode HTML entities and URL encoded content - const decodedData = needsDecoding(data) ? he.decode(decodeURIComponent(data)) : he.decode(data); + const decodedData = needsDecoding(data) ? he.decode(safeDecodeURIComponent(data)) : he.decode(data); return purify.sanitize(decodedData); } diff --git a/package.json b/package.json index 166663e3..df6ab5a5 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "mirotalksfu", - "version": "1.7.73", + "version": "1.7.74", "description": "WebRTC SFU browser-based video calls", "main": "Server.js", "scripts": { diff --git a/public/js/Brand.js b/public/js/Brand.js index 273485b5..a31101e0 100644 --- a/public/js/Brand.js +++ b/public/js/Brand.js @@ -64,7 +64,7 @@ let BRAND = { }, about: { imageUrl: '../images/mirotalk-logo.gif', - title: 'WebRTC SFU v1.7.73', + title: 'WebRTC SFU v1.7.74', html: `