diff options
| author | zeripath <art27@cantab.net> | 2022-08-17 20:43:53 +0100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2022-08-17 15:43:53 -0400 |
| commit | 87ca739a3f70b4e7e298f65630533499fc101259 (patch) | |
| tree | 0215e828a1fcf49b63968cc4d63813076b641577 /web_src | |
| parent | c138e76c1ce487beb6a34737a96d7c9239a50cd1 (diff) | |
| download | gitea-87ca739a3f70b4e7e298f65630533499fc101259.tar.gz gitea-87ca739a3f70b4e7e298f65630533499fc101259.zip | |
Correctly escape within tribute.js (#20831)
When writing html in tribute.js ensure that strings are properly escaped.
Signed-off-by: Andrew Thornton <art27@cantab.net>
Signed-off-by: Andrew Thornton <art27@cantab.net>
Diffstat (limited to 'web_src')
| -rw-r--r-- | web_src/js/features/tribute.js | 9 |
1 files changed, 5 insertions, 4 deletions
diff --git a/web_src/js/features/tribute.js b/web_src/js/features/tribute.js index 053804c43d..5678acdf47 100644 --- a/web_src/js/features/tribute.js +++ b/web_src/js/features/tribute.js @@ -1,5 +1,6 @@ import {emojiKeys, emojiHTML, emojiString} from './emoji.js'; import {uniq} from '../utils.js'; +import {htmlEscape} from 'escape-goat'; function makeCollections({mentions, emoji}) { const collections = []; @@ -24,7 +25,7 @@ function makeCollections({mentions, emoji}) { return emojiString(item.original); }, menuItemTemplate: (item) => { - return `<div class="tribute-item">${emojiHTML(item.original)}<span>${item.original}</span></div>`; + return `<div class="tribute-item">${emojiHTML(item.original)}<span>${htmlEscape(item.original)}</span></div>`; } }); } @@ -36,9 +37,9 @@ function makeCollections({mentions, emoji}) { menuItemTemplate: (item) => { return ` <div class="tribute-item"> - <img src="${item.original.avatar}"/> - <span class="name">${item.original.name}</span> - ${item.original.fullname && item.original.fullname !== '' ? `<span class="fullname">${item.original.fullname}</span>` : ''} + <img src="${htmlEscape(item.original.avatar)}"/> + <span class="name">${htmlEscape(item.original.name)}</span> + ${item.original.fullname && item.original.fullname !== '' ? `<span class="fullname">${htmlEscape(item.original.fullname)}</span>` : ''} </div> `; } |