Use "Safe" modifier for manually constructed safe HTML strings in templates (#29227)

Follow #29165. These HTML strings are safe to be rendered directly, to
avoid double-escaping.

diff --git a/templates/admin/packages/list.tmpl b/templates/admin/packages/list.tmpl
index 5cfd9ddefa63ebc46ea8f5ec1d34e1d60ff052ce..04f76748d081fd0dde9398948be57f61aca657db 100644 (file)
--- a/templates/admin/packages/list.tmpl
+++ b/templates/admin/packages/list.tmpl
@@ -88,7 +88,7 @@
                {{ctx.Locale.Tr "packages.settings.delete"}}
        </div>
        <div class="content">
-               {{ctx.Locale.Tr "packages.settings.delete.notice" `<span class="name"></span>` `<span class="dataVersion"></span>` | Safe}}
+               {{ctx.Locale.Tr "packages.settings.delete.notice" (`<span class="name"></span>`|Safe) (`<span class="dataVersion"></span>`|Safe)}}
        </div>
        {{template "base/modal_actions_confirm" .}}
 </div>

diff --git a/templates/admin/repo/list.tmpl b/templates/admin/repo/list.tmpl
index fdba0734a2abc7689161755c1829bd4c2b098006..c7a6ec7e4e9f8ab14e94014d5bad240237314654 100644 (file)
--- a/templates/admin/repo/list.tmpl
+++ b/templates/admin/repo/list.tmpl
@@ -101,7 +101,7 @@
        </div>
        <div class="content">
                <p>{{ctx.Locale.Tr "repo.settings.delete_desc"}}</p>
-               {{ctx.Locale.Tr "repo.settings.delete_notices_2" `<span class="name"></span>` | Safe}}<br>
+               {{ctx.Locale.Tr "repo.settings.delete_notices_2" (`<span class="name"></span>`|Safe)}}<br>
                {{ctx.Locale.Tr "repo.settings.delete_notices_fork_1"}}<br>
        </div>
        {{template "base/modal_actions_confirm" .}}

diff --git a/templates/admin/stacktrace.tmpl b/templates/admin/stacktrace.tmpl
index 894e41f8d7e51eb53a81970b1784d211a297d086..aa5e810cd780de1aedf53a787a1dcaf1a315274e 100644 (file)
--- a/templates/admin/stacktrace.tmpl
+++ b/templates/admin/stacktrace.tmpl
@@ -39,7 +39,7 @@
                {{ctx.Locale.Tr "admin.monitor.process.cancel"}}
        </div>
        <div class="content">
-               <p>{{ctx.Locale.Tr "admin.monitor.process.cancel_notices" `<span class="name"></span>` | Safe}}</p>
+               <p>{{ctx.Locale.Tr "admin.monitor.process.cancel_notices" (`<span class="name"></span>`|Safe)}}</p>
                <p>{{ctx.Locale.Tr "admin.monitor.process.cancel_desc"}}</p>
        </div>
        {{template "base/modal_actions_confirm" .}}

diff --git a/templates/org/member/members.tmpl b/templates/org/member/members.tmpl
index e4ddb69805b8d64565ea2a852a3d1391ab88f269..03509ec93e384e04c251004b2235d81259e7bc50 100644 (file)
--- a/templates/org/member/members.tmpl
+++ b/templates/org/member/members.tmpl
@@ -73,7 +73,7 @@
                {{ctx.Locale.Tr "org.members.leave"}}
        </div>
        <div class="content">
-               <p>{{ctx.Locale.Tr "org.members.leave.detail" `<span class="dataOrganizationName"></span>` | Safe}}</p>
+               <p>{{ctx.Locale.Tr "org.members.leave.detail" (`<span class="dataOrganizationName"></span>`|Safe)}}</p>
        </div>
        {{template "base/modal_actions_confirm" .}}
 </div>
@@ -82,7 +82,7 @@
                {{ctx.Locale.Tr "org.members.remove"}}
        </div>
        <div class="content">
-               <p>{{ctx.Locale.Tr "org.members.remove.detail" `<span class="name"></span>` `<span class="dataOrganizationName"></span>` | Safe}}</p>
+               <p>{{ctx.Locale.Tr "org.members.remove.detail" (`<span class="name"></span>`|Safe) (`<span class="dataOrganizationName"></span>`|Safe)}}</p>
        </div>
        {{template "base/modal_actions_confirm" .}}
 </div>

diff --git a/templates/org/team/members.tmpl b/templates/org/team/members.tmpl
index da63d82967a208558081f694bed5b5c444effdca..dd4ece14335a1ba6a211e8b2d92c51b27a1465dd 100644 (file)
--- a/templates/org/team/members.tmpl
+++ b/templates/org/team/members.tmpl
@@ -81,7 +81,7 @@
                {{ctx.Locale.Tr "org.members.remove"}}
        </div>
        <div class="content">
-               <p>{{ctx.Locale.Tr "org.members.remove.detail" `<span class="name"></span>` `<span class="dataTeamName"></span>` | Safe}}</p>
+               <p>{{ctx.Locale.Tr "org.members.remove.detail" (`<span class="name"></span>`|Safe) (`<span class="dataTeamName"></span>`|Safe)}}</p>
        </div>
        {{template "base/modal_actions_confirm" .}}
 </div>

diff --git a/templates/org/team/sidebar.tmpl b/templates/org/team/sidebar.tmpl
index 29e7cf7cdd90d62bd24d5e418c8705a3532a5b42..37550ab71fae13f7bd01f056ac2f80a0210bb37a 100644 (file)
--- a/templates/org/team/sidebar.tmpl
+++ b/templates/org/team/sidebar.tmpl
@@ -88,7 +88,7 @@
                {{ctx.Locale.Tr "org.teams.leave"}}
        </div>
        <div class="content">
-               <p>{{ctx.Locale.Tr "org.teams.leave.detail" `<span class="name"></span>` | Safe}}</p>
+               <p>{{ctx.Locale.Tr "org.teams.leave.detail" (`<span class="name"></span>`|Safe)}}</p>
        </div>
        {{template "base/modal_actions_confirm" .}}
 </div>

diff --git a/templates/org/team/teams.tmpl b/templates/org/team/teams.tmpl
index f4ceada2a7458d1ffd1b92ba9e31582ba81765a8..b518d7d9d738d5948e1511b81215df7f21109a63 100644 (file)
--- a/templates/org/team/teams.tmpl
+++ b/templates/org/team/teams.tmpl
@@ -49,7 +49,7 @@
                {{ctx.Locale.Tr "org.teams.leave"}}
        </div>
        <div class="content">
-               <p>{{ctx.Locale.Tr "org.teams.leave.detail" `<span class="name"></span>` | Safe}}</p>
+               <p>{{ctx.Locale.Tr "org.teams.leave.detail" (`<span class="name"></span>`|Safe)}}</p>
        </div>
        {{template "base/modal_actions_confirm" .}}
 </div>

diff --git a/templates/repo/commit_page.tmpl b/templates/repo/commit_page.tmpl
index 01fa45babe66ce587fef0981845e90b3c06de61b..ce9fcecd8b8ad1fab4a91072ed6b8ee856bd4c91 100644 (file)
--- a/templates/repo/commit_page.tmpl
+++ b/templates/repo/commit_page.tmpl
@@ -88,7 +88,7 @@
                                                                                                {{.CsrfTokenHtml}}
                                                                                                <div class="field">
                                                                                                        <label>
-                                                                                                               {{ctx.Locale.Tr "repo.branch.new_branch_from" `<span class="text" id="modal-create-branch-from-span"></span>` | Safe}}
+                                                                                                               {{ctx.Locale.Tr "repo.branch.new_branch_from" (`<span class="text" id="modal-create-branch-from-span"></span>`|Safe)}}
                                                                                                        </label>
                                                                                                </div>
                                                                                                <div class="required field">
@@ -113,7 +113,7 @@
                                                                                                <input type="hidden" name="create_tag" value="true">
                                                                                                <div class="field">
                                                                                                        <label>
-                                                                                                               {{ctx.Locale.Tr "repo.tag.create_tag_from" `<span class="text" id="modal-create-tag-from-span"></span>` | Safe}}
+                                                                                                               {{ctx.Locale.Tr "repo.tag.create_tag_from" (`<span class="text" id="modal-create-tag-from-span"></span>`|Safe)}}
                                                                                                        </label>
                                                                                                </div>
                                                                                                <div class="required field">

diff --git a/templates/repo/issue/view_content/comments.tmpl b/templates/repo/issue/view_content/comments.tmpl
index c1797ba77d5c02d4d3716e5fc77f16f4c8a73323..ed83377f5a22d11fafc297aacb3fafa7b39983b3 100644 (file)
--- a/templates/repo/issue/view_content/comments.tmpl
+++ b/templates/repo/issue/view_content/comments.tmpl
@@ -112,9 +112,9 @@
                                        {{template "shared/user/authorlink" .Poster}}
                                        {{$link := printf "%s/commit/%s" $.Repository.Link ($.Issue.PullRequest.MergedCommitID|PathEscape)}}
                                        {{if eq $.Issue.PullRequest.Status 3}}
-                                               {{ctx.Locale.Tr "repo.issues.comment_manually_pull_merged_at" (printf `<a class="ui sha" href="%[1]s"><b>%[2]s</b></a>` ($link|Escape) (ShortSha $.Issue.PullRequest.MergedCommitID)) (printf "<b>%[1]s</b>" ($.BaseTarget|Escape)) $createdStr | Safe}}
+                                               {{ctx.Locale.Tr "repo.issues.comment_manually_pull_merged_at" (printf `<a class="ui sha" href="%[1]s"><b>%[2]s</b></a>` ($link|Escape) (ShortSha $.Issue.PullRequest.MergedCommitID) | Safe) (printf "<b>%[1]s</b>" ($.BaseTarget|Escape) | Safe) $createdStr}}
                                        {{else}}
-                                               {{ctx.Locale.Tr "repo.issues.comment_pull_merged_at" (printf `<a class="ui sha" href="%[1]s"><b>%[2]s</b></a>` ($link|Escape) (ShortSha $.Issue.PullRequest.MergedCommitID)) (printf "<b>%[1]s</b>" ($.BaseTarget|Escape)) $createdStr | Safe}}
+                                               {{ctx.Locale.Tr "repo.issues.comment_pull_merged_at" (printf `<a class="ui sha" href="%[1]s"><b>%[2]s</b></a>` ($link|Escape) (ShortSha $.Issue.PullRequest.MergedCommitID) | Safe) (printf "<b>%[1]s</b>" ($.BaseTarget|Escape) | Safe) $createdStr}}
                                        {{end}}
                                </span>
                        </div>

diff --git a/templates/repo/issue/view_content/pull.tmpl b/templates/repo/issue/view_content/pull.tmpl
index f1ab53eb677c4e43da3521bc43b672b773ddace9..a28b849f98909bef2ae9117ebd780061f5bf0839 100644 (file)
--- a/templates/repo/issue/view_content/pull.tmpl
+++ b/templates/repo/issue/view_content/pull.tmpl
@@ -38,7 +38,7 @@
                                                                {{ctx.Locale.Tr "repo.pulls.merged_success"}}
                                                        </h3>
                                                        <div class="merge-section-info">
-                                                               {{ctx.Locale.Tr "repo.pulls.merged_info_text" (printf "<code>%s</code>" (.HeadTarget | Escape)) | Str2html}}
+                                                               {{ctx.Locale.Tr "repo.pulls.merged_info_text" (printf "<code>%s</code>" (.HeadTarget | Escape) | Safe)}}
                                                        </div>
                                                </div>
                                                <div class="item-section-right">

diff --git a/templates/repo/settings/webhook/settings.tmpl b/templates/repo/settings/webhook/settings.tmpl
index 3dfa094cf5ac6d12e7ec2c8a51de63e559a105a0..8e2387067e31f8b632b882542f5c99d555ba3ba7 100644 (file)
--- a/templates/repo/settings/webhook/settings.tmpl
+++ b/templates/repo/settings/webhook/settings.tmpl
@@ -263,7 +263,7 @@
        <label for="authorization_header">{{ctx.Locale.Tr "repo.settings.authorization_header"}}</label>
        <input id="authorization_header" name="authorization_header" type="text" value="{{.Webhook.HeaderAuthorization}}"{{if eq .HookType "matrix"}} placeholder="Bearer $access_token" required{{end}}>
        {{if ne .HookType "matrix"}}{{/* Matrix doesn't make the authorization optional but it is implied by the help string, should be changed.*/}}
-               <span class="help">{{ctx.Locale.Tr "repo.settings.authorization_header_desc" "<code>Bearer token123456</code>, <code>Basic YWxhZGRpbjpvcGVuc2VzYW1l</code>" | Str2html}}</span>
+               <span class="help">{{ctx.Locale.Tr "repo.settings.authorization_header_desc" ("<code>Bearer token123456</code>, <code>Basic YWxhZGRpbjpvcGVuc2VzYW1l</code>" | Safe)}}</span>
        {{end}}
 </div>
 

diff --git a/templates/user/settings/organization.tmpl b/templates/user/settings/organization.tmpl
index 80795219840689f99768b29c996a46654a654d64..102ff2e95bcc9c62cde1deb4ec028c7b22fe50be 100644 (file)
--- a/templates/user/settings/organization.tmpl
+++ b/templates/user/settings/organization.tmpl
@@ -47,7 +47,7 @@
                {{ctx.Locale.Tr "org.members.leave"}}
        </div>
        <div class="content">
-               <p>{{ctx.Locale.Tr "org.members.leave.detail" `<span class="dataOrganizationName"></span>` | Safe}}</p>
+               <p>{{ctx.Locale.Tr "org.members.leave.detail" (`<span class="dataOrganizationName"></span>`|Safe)}}</p>
        </div>
        {{template "base/modal_actions_confirm" .}}
 </div>