domi/forgejo-domi
1
0
Fork 0
forked from forgejo/forgejo
Code Pull requests Activity

Prevent possible XSS when using jQuery (#18289)

Browse source 
In the case of misuse or misunderstanding from a developer whereby,
if `sel` can receive user-controlled data, jQuery `$(sel)` can lead to the
creation of a new element. Current usage is using hard-coded selectors
in the templates, but nobody prevents that from expanding to
user-controlled somehow.
This commit is contained in:
Gusted 2022-01-16 05:14:32 +00:00 • committed by GitHub
parent 4b4884ce88
commit 661d3d28e9
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
10 changed files with 39 additions and 34 deletions
Download patch file Download diff file Expand all files Collapse all files

4
web_src/js/features/repo-issue.js
View file

@ -28,7 +28,7 @@ export function initRepoIssueTimeTracking() {
});
$(document).on('click', 'button.issue-delete-time', function () {
const sel = `.issue-delete-time-modal[data-id="${$(this).data('id')}"]`;
$(sel).modal({
$.find(sel).modal({
duration: 200,
onApprove() {
$(`${sel} form`).trigger('submit');
@ -535,7 +535,7 @@ export function initRepoIssueReferenceIssue() {
const content = $(`#comment-${$this.data('target')}`).text();
const poster = $this.data('poster-username');
const reference = $this.data('reference');
const $modal = $($this.data('modal'));
const $modal = $.find($this.data('modal'));
$modal.find('textarea[name="content"]').val(`${content}\n\n_Originally posted by @${poster} in ${reference}_`);
$modal.modal('show');