removing iframes from pasted content to prevent frame injection attack

Signed-off-by: Ananya Sen <Ananya.Sen@motorola.com>

1 files changed, 4 insertions, 3 deletions

diff --git a/js/clipboard/external-apps-clipboard-agent.js b/js/clipboard/external-apps-clipboard-agent.js
index 5a82314b..65410543 100644
--- a/js/clipboard/external-apps-clipboard-agent.js
+++ b/js/clipboard/external-apps-clipboard-agent.js
@@ -186,9 +186,10 @@ var ExternalAppsClipboardAgent = exports.ExternalAppsClipboardAgent = Montage.cr
     sanitize : {
         value: function(data){
             data = data.replace(/\<meta [^>]+>/gi, ""); // Remove meta tags
-            data = data.replace(/\<script [^>]+>/g," "); // Remove script tags
-            data = data.replace(/\<link [^>]+>/g," "); // Remove script tags
-            data = data.replace(/\<xml [^>]+>/g," "); // Remove script tags
+            data = data.replace(/\<script [^>]+>/g," "); // Remove script tags to prevenet script injection attack
+            data = data.replace(/\<link [^>]+>/g," "); // Remove link tags to prevent unwanted css files that may corrupt the stage
+            data = data.replace(/\<xml [^>]+>/g," "); // Remove xml tags since it works only for IE browsers
+            data = data.replace(/\<iframe [^>]+>/g," "); // Remove iframe tags to prevent iframe injection attack
 
             return data;
         }