diff options
| author | Unknwon <u@gogs.io> | 2017-02-15 18:05:02 -0500 |
|---|---|---|
| committer | Kim "BKC" Carlbäcker <kim.carlbacker@gmail.com> | 2017-02-16 04:06:20 +0100 |
| commit | 134f3e6e09ed0583bc377a08ef46a51013635a2e (patch) | |
| tree | 0226e2d5ecd4bdb2ff8701d216f82fc960d90ae7 | |
| parent | 43c94d0a6cd8daf01125df3bf895f1beb1bcd664 (diff) | |
| download | gitea-134f3e6e09ed0583bc377a08ef46a51013635a2e.tar.gz gitea-134f3e6e09ed0583bc377a08ef46a51013635a2e.zip | |
Security: prevent XSS attach on wiki page
Reported by Miguel Ángel Jimeno.
| -rw-r--r-- | modules/templates/helper.go | 2 | ||||
| -rw-r--r-- | templates/repo/wiki/view.tmpl | 11 |
2 files changed, 8 insertions, 5 deletions
diff --git a/modules/templates/helper.go b/modules/templates/helper.go index 0c56ae0e0a..b03128a0b1 100644 --- a/modules/templates/helper.go +++ b/modules/templates/helper.go @@ -15,6 +15,7 @@ import ( "strings" "time" + "github.com/microcosm-cc/bluemonday" "golang.org/x/net/html/charset" "golang.org/x/text/transform" "gopkg.in/editorconfig/editorconfig-core-go.v1" @@ -61,6 +62,7 @@ func NewFuncMap() []template.FuncMap { }, "AvatarLink": base.AvatarLink, "Safe": Safe, + "Sanitize": bluemonday.UGCPolicy().Sanitize, "Str2html": Str2html, "TimeSince": base.TimeSince, "RawTimeSince": base.RawTimeSince, diff --git a/templates/repo/wiki/view.tmpl b/templates/repo/wiki/view.tmpl index 9a1a984b63..b9aa4e9560 100644 --- a/templates/repo/wiki/view.tmpl +++ b/templates/repo/wiki/view.tmpl @@ -1,6 +1,7 @@ {{template "base/head" .}} <div class="repository wiki view"> {{template "repo/header" .}} + {{ $title := .title | Sanitize}} <div class="ui container"> <div class="ui grid"> <div class="ui ten wide column"> @@ -9,7 +10,7 @@ <div class="ui basic small button"> <span class="text"> {{.i18n.Tr "repo.wiki.page"}}: - <strong>{{.title}}</strong> + <strong>{{$title}}</strong> </span> <i class="dropdown icon"></i> </div> @@ -20,7 +21,7 @@ </div> <div class="scrolling menu"> {{range .Pages}} - <div class="item {{if eq $.Title .Name}}selected{{end}}" data-url="{{$.RepoLink}}/wiki/{{.URL}}">{{.Name}}</div> + <div class="item {{if eq $.Title .Name}}selected{{end}}" data-url="{{$.RepoLink}}/wiki/{{.URL}}">{{.Name | Sanitize}}</div> {{end}} </div> </div> @@ -50,8 +51,8 @@ </div> </div> </div> - <div class="ui header"> - {{.title}} + <div class="ui dividing header"> + {{$title}} {{if and .IsRepositoryWriter (not .Repository.IsMirror)}} <div class="ui right"> <a class="ui small button" href="{{.RepoLink}}/wiki/{{EscapePound .PageURL}}/_edit">{{.i18n.Tr "repo.wiki.edit_page_button"}}</a> @@ -95,7 +96,7 @@ {{.i18n.Tr "repo.wiki.delete_page_button"}} </div> <div class="content"> - <p>{{.i18n.Tr "repo.wiki.delete_page_notice_1" .title | Safe}}</p> + <p>{{.i18n.Tr "repo.wiki.delete_page_notice_1" $title | Safe}}</p> </div> {{template "base/delete_modal_actions" .}} </div> |