diff options
| author | Gusted <williamzijl7@hotmail.com> | 2022-01-16 05:14:32 +0000 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2022-01-16 13:14:32 +0800 |
| commit | 661d3d28e97bb49bef075c0314edad5879148aaa (patch) | |
| tree | 9b4a0c1a8244b003b9467f861088d6eadbaafabc /web_src/js/components | |
| parent | 4b4884ce889439f092d3797984e768e0cf2a278e (diff) | |
| download | gitea-661d3d28e97bb49bef075c0314edad5879148aaa.tar.gz gitea-661d3d28e97bb49bef075c0314edad5879148aaa.zip | |
Prevent possible XSS when using jQuery (#18289)
In the case of misuse or misunderstanding from a developer whereby,
if `sel` can receive user-controlled data, jQuery `$(sel)` can lead to the
creation of a new element. Current usage is using hard-coded selectors
in the templates, but nobody prevents that from expanding to
user-controlled somehow.
Diffstat (limited to 'web_src/js/components')
| -rw-r--r-- | web_src/js/components/RepoBranchTagDropdown.js | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/web_src/js/components/RepoBranchTagDropdown.js b/web_src/js/components/RepoBranchTagDropdown.js index 50c71d5bac..2b260e9399 100644 --- a/web_src/js/components/RepoBranchTagDropdown.js +++ b/web_src/js/components/RepoBranchTagDropdown.js @@ -2,7 +2,7 @@ import Vue from 'vue'; import {vueDelimiters} from './VueComponentLoader.js'; export function initRepoBranchTagDropdown(selector) { - $(selector).each(function () { + $.find(selector).each(function () { const $dropdown = $(this); const $data = $dropdown.find('.data'); const data = { |