From: Wouter Admiraal <wouter.admiraal@sonarsource.com>
Date: Fri, 19 Jun 2020 08:47:02 +0000 (+0200)
Subject: SONAR-11914 Fix SSF-76
X-Git-Tag: 8.4.0.35506~20
X-Git-Url: https://source.dussan.org/?a=commitdiff_plain;h=b3840f39050b6a805c321748c84726038ccb3f6a;p=sonarqube.git

SONAR-11914 Fix SSF-76
---

diff --git a/server/sonar-web/src/main/js/apps/about/components/AboutApp.tsx b/server/sonar-web/src/main/js/apps/about/components/AboutApp.tsx
index c8cac2354f3..4f53635a2c8 100644
--- a/server/sonar-web/src/main/js/apps/about/components/AboutApp.tsx
+++ b/server/sonar-web/src/main/js/apps/about/components/AboutApp.tsx
@@ -17,6 +17,7 @@
  * along with this program; if not, write to the Free Software Foundation,
  * Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
  */
+import { sanitize } from 'dompurify';
 import { Location } from 'history';
 import { keyBy } from 'lodash';
 import * as React from 'react';
@@ -159,8 +160,8 @@ export class AboutApp extends React.PureComponent<Props, State> {
           {customText && (
             <div
               className="about-page-section"
-              // Safe: Defined by instance admin
-              dangerouslySetInnerHTML={{ __html: customText }}
+              // eslint-disable-next-line react/no-danger
+              dangerouslySetInnerHTML={{ __html: sanitize(customText) }}
             />
           )}