Prevent possible XSS when using jQuery (#18289)

In the case of misuse or misunderstanding from a developer whereby,
if `sel` can receive user-controlled data, jQuery `$(sel)` can lead to the
creation of a new element. Current usage is using hard-coded selectors
in the templates, but nobody prevents that from expanding to
user-controlled somehow.

1 files changed, 3 insertions, 3 deletions

diff --git a/web_src/js/features/repo-settings.js b/web_src/js/features/repo-settings.js
index b0d43bd487..9568d1e80d 100644
--- a/web_src/js/features/repo-settings.js
+++ b/web_src/js/features/repo-settings.js
@@ -52,14 +52,14 @@ export function initRepoSettingBranches() {
     initRepoCommonFilterSearchDropdown('.protected-branches .dropdown');
     $('.enable-protection, .enable-whitelist, .enable-statuscheck').on('change', function () {
       if (this.checked) {
-        $($(this).data('target')).removeClass('disabled');
+        $.find($(this).data('target')).removeClass('disabled');
       } else {
-        $($(this).data('target')).addClass('disabled');
+        $.find($(this).data('target')).addClass('disabled');
       }
     });
     $('.disable-whitelist').on('change', function () {
       if (this.checked) {
-        $($(this).data('target')).addClass('disabled');
+        $.find($(this).data('target')).addClass('disabled');
       }
     });
   }