worldcone/forgejo
2
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

Immediate fix to htmlEncode user added text (#5570)

Browse source 
There are likely problems remaining with the way that initCommentForm
is creating its elements. I suspect that a malformed avatar url could
be used maliciously.
This commit is contained in:
zeripath 2018-12-21 13:40:40 +00:00 committed by techknowlogick
parent 4a02a783c4
commit 330bf8d3b3
1 changed files with 9 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
public/js/index.js
View file

@ -1,5 +1,9 @@
'use strict';
function htmlEncode(text) {
return jQuery('<div />').text(text).html()
}
var csrf;
var suburl;
@ -394,12 +398,12 @@ function initCommentForm() {
switch (input_id) {
case '#milestone_id':
$list.find('.selected').html('<a class="item" href=' + $(this).data('href') + '>' +
$(this).text() + '</a>');
htmlEncode($(this).text()) + '</a>');
break;
case '#assignee_id':
$list.find('.selected').html('<a class="item" href=' + $(this).data('href') + '>' +
'<img class="ui avatar image" src=' + $(this).data('avatar') + '>' +
$(this).text() + '</a>');
htmlEncode($(this).text()) + '</a>');
}
$('.ui' + select_id + '.list .no-select').addClass('hide');
$(input_id).val($(this).data('id'));
@ -1538,7 +1542,7 @@ function searchUsers() {
$.each(response.data, function (i, item) {
var title = item.login;
if (item.full_name && item.full_name.length > 0) {
title += ' (' + item.full_name + ')';
title += ' (' + htmlEncode(item.full_name) + ')';
}
items.push({
title: title,
@ -2813,7 +2817,7 @@ function initIssueList() {
// Parse the response from the api to work with our dropdown
$.each(response, function(index, issue) {
filteredResponse.results.push({
'name' : '#' + issue.number + '&nbsp;' + issue.title,
'name' : '#' + issue.number + '&nbsp;' + htmlEncode(issue.title),
'value' : issue.id
});
});