Skip to content

Commit

Permalink
Correctly escape within tribute.js (go-gitea#20831)
Browse files Browse the repository at this point in the history
Backport go-gitea#20831

When writing html in tribute.js ensure that strings are properly escaped.

Signed-off-by: Andrew Thornton <art27@cantab.net>
  • Loading branch information
zeripath committed Aug 17, 2022
1 parent 79fa1c1 commit cf17cfd
Showing 1 changed file with 5 additions and 4 deletions.
9 changes: 5 additions & 4 deletions web_src/js/features/tribute.js
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
import {emojiKeys, emojiHTML, emojiString} from './emoji.js';
import {uniq} from '../utils.js';
import {htmlEscape} from 'escape-goat';

function makeCollections({mentions, emoji}) {
const collections = [];
Expand All @@ -24,7 +25,7 @@ function makeCollections({mentions, emoji}) {
return emojiString(item.original);
},
menuItemTemplate: (item) => {
return `<div class="tribute-item">${emojiHTML(item.original)}<span>${item.original}</span></div>`;
return `<div class="tribute-item">${emojiHTML(item.original)}<span>${htmlEscape(item.original)}</span></div>`;
}
});
}
Expand All @@ -36,9 +37,9 @@ function makeCollections({mentions, emoji}) {
menuItemTemplate: (item) => {
return `
<div class="tribute-item">
<img src="${item.original.avatar}"/>
<span class="name">${item.original.name}</span>
${item.original.fullname && item.original.fullname !== '' ? `<span class="fullname">${item.original.fullname}</span>` : ''}
<img src="${htmlEscape(item.original.avatar)}"/>
<span class="name">${htmlEscape(item.original.name)}</span>
${item.original.fullname && item.original.fullname !== '' ? `<span class="fullname">${htmlEscape(item.original.fullname)}</span>` : ''}
</div>
`;
}
Expand Down

0 comments on commit cf17cfd

Please sign in to comment.