From 661d3d28e97bb49bef075c0314edad5879148aaa Mon Sep 17 00:00:00 2001 From: Gusted Date: Sun, 16 Jan 2022 05:14:32 +0000 Subject: Prevent possible XSS when using jQuery (#18289) In the case of misuse or misunderstanding from a developer whereby, if `sel` can receive user-controlled data, jQuery `$(sel)` can lead to the creation of a new element. Current usage is using hard-coded selectors in the templates, but nobody prevents that from expanding to user-controlled somehow. --- docs/content/doc/developers/guidelines-frontend.md | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'docs/content/doc/developers') diff --git a/docs/content/doc/developers/guidelines-frontend.md b/docs/content/doc/developers/guidelines-frontend.md index 9fec5bd17e..cbd2ca8a24 100644 --- a/docs/content/doc/developers/guidelines-frontend.md +++ b/docs/content/doc/developers/guidelines-frontend.md @@ -127,3 +127,8 @@ We forbid `dataset` usage, its camel-casing behaviour makes it hard to grep for ### Vue2/Vue3 and JSX Gitea is using Vue2 now, we plan to upgrade to Vue3. We decided not to introduce JSX to keep the HTML and the JavaScript code separated. + +### jQuery's `$(...)` + +jQuery's `$` function has a broad functionality depending on the input. Well, this can be seen as nice, it's also a fallpit for possible XSS attacks when the input is user-controlled. +The usage of the function can be correct in certain situations, but it is discourage and recommended to use a more specific function of jQuery(e.g. `$.find`, `$.parseHTML`). -- cgit v1.2.3